← Vulnerability feed

Vulnerability record · CVE-2026-73500 · published 12 August 2026

CVE-2026-73500: Allocation without limits vulnerability

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

8.7 CVSS 4.0 High EPSS 0.70% · top 48.9% CWE-770 · Allocation without limits Awaiting Analysis
8.7CVSS 4.0 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
9References
18 Sep 2026Last modified by NVD

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372
https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3
https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
https://github.com/etcd-io/etcd/pull/22130
https://github.com/etcd-io/etcd/releases/tag/v3.5.33
https://github.com/etcd-io/etcd/releases/tag/v3.6.14
https://github.com/etcd-io/etcd/releases/tag/v3.7.1
https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3

Track CVE-2026-73500 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2026-73500), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.