{"uuid": "40cff5cd-b499-49bd-8ea4-39bd4fcce1ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6VCH-Q96H-7GC3", "type": "seen", "source": "https://gist.github.com/alon710/c51377a7e449134a651b4b7f09b602f4", "content": "# GHSA-6VCH-Q96H-7GC3: GHSA-6VCH-Q96H-7GC3: Unbounded Goroutine Creation and Denial of Service in etcd TLS Listener\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-6VCH-Q96H-7GC3\n\n## Summary\nA critical Denial of Service (DoS) vulnerability exists in the etcd TLS listener. Due to the lack of a handshake timeout or deadline on incoming TLS connections within the connection acceptance loop, an unauthenticated remote attacker can spawn an unbounded number of blocking goroutines and leak file descriptors, eventually exhausting system resources and causing the etcd node to crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash etcd nodes by opening raw TCP connections and withholding the TLS ClientHello, leading to resource exhaustion through leaked goroutines and open socket file descriptors.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- etcd\n- **etcd**: < 3.5.33 (Fixed in: `3.5.33`)\n- **etcd**: >= 3.6.0, < 3.6.14 (Fixed in: `3.6.14`)\n- **etcd**: >= 3.7.0, < 3.7.1 (Fixed in: `3.7.1`)\n\n## Mitigation\n\n- Upgrade etcd cluster components to patched versions (3.5.33, 3.6.14, or 3.7.1)\n- Implement network-level Access Control Lists (ACLs) to restrict access to ports 2379 and 2380\n- Deploy etcd behind a reverse proxy that enforces TLS handshake timeouts and rate-limits concurrent connections\n\n**Remediation Steps:**\n1. Identify all running etcd nodes and their current software versions.\n2. Download the official etcd release binary for version 3.5.33, 3.6.14, or 3.7.1 or higher.\n3. Perform a rolling upgrade of the etcd cluster nodes, ensuring quorum is maintained.\n4. Verify that the new etcd processes are running and peer-to-peer synchronization is operational.\n5. Apply network firewall rules to block unauthorized external traffic to etcd ports.\n\n## References\n\n- [GitHub Security Advisory GHSA-6VCH-Q96H-7GC3](https://github.com/advisories/GHSA-6VCH-Q96H-7GC3)\n- [etcd Pull Request #22130](https://github.com/etcd-io/etcd/pull/22130)\n- [etcd Release v3.5.33](https://github.com/etcd-io/etcd/releases/tag/v3.5.33)\n- [etcd Release v3.6.14](https://github.com/etcd-io/etcd/releases/tag/v3.6.14)\n- [etcd Release v3.7.1](https://github.com/etcd-io/etcd/releases/tag/v3.7.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-6VCH-Q96H-7GC3) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-24T23:31:23.524636Z"}