Is CVE-2026-33817 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33817 being exploited in the wild.

How severe is CVE-2026-33817?

Medium severity, with a CVSS score of 6.2, published 6 April 2026.

Which products and versions are affected?

Etcd-Io Bbolt <= 1.4.3; go.etcd.io/bbolt (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Is there a fix for CVE-2026-33817?

A patch was published on 2026-03-30: Fix merged in bbolt repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33817 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-33817?

Check whether you run Etcd-Io Bbolt or go.etcd.io/bbolt (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33817: etcd-io bbolt index out-of-range in Bucket.Stats

Q: Which products and versions are affected?

Etcd-Io Bbolt <= 1.4.3; go.etcd.io/bbolt (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Q: Is there a fix for CVE-2026-33817?

A patch was published on 2026-03-30: Fix merged in bbolt repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33817 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-33817?

Check whether you run Etcd-Io Bbolt or go.etcd.io/bbolt (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33817 · Severity: medium · CVSS 6.2 · Published 2026-04-06

bbolt is a widely used embedded key-value database for Go, utilized by projects like etcd and Kubernetes. A reported issue suggested that the database could crash (panic) when processing corrupted data files containing empty branch pages. However, this advisory has been withdrawn as the maintainers determined the behavior does not constitute a security vulnerability in a production context.

Vendors: Etcd-Io, Go.

Quick answers

Is CVE-2026-33817 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33817 being exploited in the wild.
How severe is CVE-2026-33817?: Medium severity, with a CVSS score of 6.2, published 6 April 2026.
Which products and versions are affected?: Etcd-Io Bbolt <= 1.4.3; go.etcd.io/bbolt (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.
Is there a fix for CVE-2026-33817?: A patch was published on 2026-03-30: Fix merged in bbolt repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33817 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-33817?: Check whether you run Etcd-Io Bbolt or go.etcd.io/bbolt (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability was originally reported as an out-of-bounds read (CWE-125) in the Bucket.Stats() function of the bbolt library. The issue occurred because the code attempted to access a branch page element using an index of -1 when the page element count was zero, leading to a Go panic. While a fix was merged to add a count guard, the advisory was subsequently withdrawn and the CVE rejected. Maintainers and the Go security team determined it to be a false positive because branch pages in a healthy bbolt database should never have zero elements, and the crash only occurs during manual statistics gathering on corrupted databases.

Affected products

etcd-io bbolt <= 1.4.3

Identifiers

CVE-2026-33817
GHSA-6jwv-w5xf-7j27
GO-2026-4923

Timeline

2026-03-30: patched: Fix merged in bbolt repository
2026-04-06: disclosed: Initial CVE and GHSA published
2026-04-08: other: CVE marked as Rejected/False Positive
2026-04-13: other: GitHub Advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.