Executive brief
etcd is a distributed key-value store that manages configuration and state for systems like Kubernetes clusters. A network attacker can establish many TCP connections to the TLS listener without completing the handshake, causing the process to consume unbounded memory and crash. When etcd backs a Kubernetes control plane, this leads to complete cluster unavailability.
Technical details
The vulnerability is a denial-of-service flaw in the TLS connection handling code (client/pkg/transport/listener_tls.go). When a client connects to the TLS listener but never sends a ClientHello message, the acceptLoop spawns a goroutine that blocks indefinitely in tls.Conn.Handshake() while remaining tracked in a pending connection map. An attacker on the network can open many such incomplete connections, causing unbounded growth of goroutines and the pending map, exhausting memory and crashing the etcd process. The fix implements a tlsHandshakeTimeout to bound the duration of incomplete handshakes. Versions 3.5.33, 3.6.14, and 3.7.1 and later are patched.
Affected products
- etcd etcd prior to 3.5.33, 3.6.14, and 3.7.1
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Versions 3.5.33, 3.6.14, and 3.7.1 and later