Executive brief
etcd is a critical database used to store configuration data for distributed systems like Kubernetes. A vulnerability in how it handles secure connections allows an attacker to crash the service by opening many connections without completing them. This can lead to a total service outage, impacting the stability of any cloud infrastructure or applications relying on the etcd cluster.
Technical details
The etcd `tlsListener.acceptLoop` fails to enforce a deadline on TLS handshakes. A remote, unauthenticated attacker can initiate a large number of TCP connections but withhold the TLS ClientHello. This causes the server to spawn a new goroutine for each connection that blocks indefinitely in `tls.Conn.Handshake()`. These goroutines, along with their associated entries in the pending connection map, consume unbounded memory, eventually leading to an Out-Of-Memory (OOM) crash of the etcd process. The fix introduces a `tlsHandshakeTimeout` (set to 10 seconds) using `SetDeadline` on the connection before the handshake begins.
Affected products
- etcd-io etcd < 3.5.33, >= 3.6.0, < 3.6.14, >= 3.7.0-alpha.0, < 3.7.1
Timeline
- 2026-07-21: patched: Initial fix merged into main branch
- 2026-07-23: disclosed
- 2026-07-24: advisory
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
- https://github.com/etcd-io/etcd/pull/22130
- https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
- https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14