go.etcd.io/etcd/client/pkg/v3 vulnerabilities

Latest go.etcd.io/etcd/client/pkg/v3 CVEs

Newest publication first

1. CVE-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

   Published 2026-08-12

   High·CVSS 8.7 EPSS 0.40%

   etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each...

2. GHSA-5x4g-q5rc-36jp Etcd pkg Insecure ciphers are allowed by default

   Published 2024-02-03

   Unknown

   Vulnerability type Cryptography Detail The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty. Workarounds By default, no action...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.