DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-6VCH-Q96H-7GC3: GHSA-6VCH-Q96H-7GC3: Unbounded Goroutine Creation and Denial of Service in etcd TLS Listener

#security #cve #cybersecurity #ghsa

GHSA-6VCH-Q96H-7GC3: Unbounded Goroutine Creation and Denial of Service in etcd TLS Listener

Vulnerability ID: GHSA-6VCH-Q96H-7GC3
CVSS Score: 7.5
Published: 2026-07-24

A critical Denial of Service (DoS) vulnerability exists in the etcd TLS listener. Due to the lack of a handshake timeout or deadline on incoming TLS connections within the connection acceptance loop, an unauthenticated remote attacker can spawn an unbounded number of blocking goroutines and leak file descriptors, eventually exhausting system resources and causing the etcd node to crash.

TL;DR

Unauthenticated remote attackers can crash etcd nodes by opening raw TCP connections and withholding the TLS ClientHello, leading to resource exhaustion through leaked goroutines and open socket file descriptors.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS Score: 7.5 (High)
  • EPSS Score: 0.00
  • Impact: Denial of Service (DoS)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • etcd
  • etcd: < 3.5.33 (Fixed in: 3.5.33)
  • etcd: >= 3.6.0, < 3.6.14 (Fixed in: 3.6.14)
  • etcd: >= 3.7.0, < 3.7.1 (Fixed in: 3.7.1)

Code Analysis

Commit: 2e07efc

client/pkg/transport: set TLS handshake timeout

Commit: f73cba7

pkg/transport: add TLS handshake timeout

Mitigation Strategies

  • Upgrade etcd cluster components to patched versions (3.5.33, 3.6.14, or 3.7.1)
  • Implement network-level Access Control Lists (ACLs) to restrict access to ports 2379 and 2380
  • Deploy etcd behind a reverse proxy that enforces TLS handshake timeouts and rate-limits concurrent connections

Remediation Steps:

  1. Identify all running etcd nodes and their current software versions.
  2. Download the official etcd release binary for version 3.5.33, 3.6.14, or 3.7.1 or higher.
  3. Perform a rolling upgrade of the etcd cluster nodes, ensuring quorum is maintained.
  4. Verify that the new etcd processes are running and peer-to-peer synchronization is operational.
  5. Apply network firewall rules to block unauthorized external traffic to etcd ports.

References

Read the full report for GHSA-6VCH-Q96H-7GC3 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)