CVE-2026-73500: etcd Denial of Service Vulnerability

CVE-2026-73500 Overview

CVE-2026-73500 is a resource exhaustion vulnerability [CWE-770] in etcd, the distributed key-value store used by Kubernetes and many other distributed systems. A network attacker who can reach an etcd TLS listener can open many TCP connections without ever sending a ClientHello. Each connection spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in a pending map. Unbounded goroutine and map growth exhaust process memory, causing loss of cluster availability. When etcd backs Kubernetes, the entire control plane fails. The issue is fixed in etcd versions 3.5.33, 3.6.14, and 3.7.1.

Critical Impact
Unauthenticated network attackers can crash etcd nodes through memory exhaustion, taking down the Kubernetes control plane and any cluster relying on etcd for state storage.

Affected Products

etcd versions prior to 3.5.33 (3.5.x branch)
etcd versions prior to 3.6.14 (3.6.x branch)
etcd versions prior to 3.7.1 (3.7.x branch)

Discovery Timeline

2026-08-12 - CVE-2026-73500 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73500

Vulnerability Analysis

The vulnerability lives in client/pkg/transport/listener_tls.go. The tlsListener.acceptLoop function accepts inbound TCP connections and immediately spawns a goroutine per connection to complete the TLS handshake. Each in-flight connection is also inserted into a pending map so the listener can track handshakes.

Go's tls.Conn.Handshake() has no default deadline. If a client establishes the TCP connection but never sends a ClientHello, the goroutine calling Handshake() blocks indefinitely on the underlying net.Conn.Read(). The corresponding pending map entry is never removed.

An attacker exploits this by opening TCP connections in a loop and holding them open silently. Each connection consumes goroutine stack memory plus map bookkeeping. With no upper bound on connection count or handshake duration, the etcd process eventually exhausts available memory and is killed by the operating system or Go runtime.

Root Cause

The root cause is a missing handshake timeout on TLS-accepted connections combined with unbounded tracking in the pending map. This maps directly to CWE-770: Allocation of Resources Without Limits or Throttling.

Attack Vector

The attack requires network reachability to an etcd TLS listener but no authentication and no user interaction. An attacker sends a flood of half-open TLS connections from one or more source addresses. Because the handshake never begins, standard TLS-layer telemetry may not fire.

 	"os"
 	"strings"
 	"sync"
+	"time"
+)
+
+const (
+	// tlsHandshakeTimeout bounds how long a single TLS handshake may block.
+	tlsHandshakeTimeout = 10 * time.Second
 )
 
 // tlsListener overrides a TLS listener so it will reject client

Source: etcd commit 2e07efc. The patch introduces a 10-second bound on handshake duration, ensuring stalled connections are terminated and removed from the pending map.

Detection Methods for CVE-2026-73500

Indicators of Compromise

Sustained growth in the number of open TCP connections to etcd client or peer TLS ports (default 2379 and 2380) from a small set of source addresses.
Rising etcd process resident memory and goroutine count with no corresponding increase in legitimate request throughput.
TCP connections to etcd TLS ports that remain in ESTABLISHED state without exchanging TLS handshake bytes.
etcd node crashes with out-of-memory errors or Go runtime fatal error: runtime: out of memory messages.

Detection Strategies

Monitor the etcd metric etcd_server_go_goroutines and process RSS for abnormal growth patterns divorced from request rate.
Alert on TCP connection counts to ports 2379 and 2380 exceeding historical baselines.
Use packet inspection or flow logs to identify TCP sessions to etcd where no TLS ClientHello is observed within a short window after the SYN-ACK.

Monitoring Recommendations

Forward etcd Prometheus metrics and host-level memory metrics into a centralized analytics platform for baseline deviation analysis.
Track Kubernetes API server availability metrics as a downstream indicator of etcd degradation.
Log source IP addresses of all connections to etcd endpoints and correlate against expected client inventories such as kube-apiserver nodes and etcd peers.

How to Mitigate CVE-2026-73500

Immediate Actions Required

Upgrade etcd to version 3.5.33, 3.6.14, or 3.7.1 depending on the deployed branch.
Restrict network access to etcd client port 2379 and peer port 2380 to only Kubernetes control plane nodes and authorized administrative hosts.
Place etcd endpoints behind network-layer rate limiting or connection-count controls where feasible.
Audit firewall rules and security groups to confirm etcd is not reachable from untrusted networks or the public internet.

Patch Information

The fix is available in etcd v3.5.33, etcd v3.6.14, and etcd v3.7.1. The patch is tracked in Pull Request #22130 and detailed in GitHub Security Advisory GHSA-6vch-q96h-7gc3. The change introduces a tlsHandshakeTimeout constant of 10 seconds and applies it to every accepted TLS connection.

Workarounds

Enforce strict network segmentation so only known control plane components can reach etcd TLS listeners.
Deploy a Layer 4 proxy or firewall in front of etcd that enforces per-source connection limits and idle timeouts on half-open sessions.
Configure host-level connection tracking limits and TCP keepalive settings to reap silent connections faster.

bash

# Example: restrict access to etcd client and peer ports using iptables
iptables -A INPUT -p tcp --dport 2379 -s <control-plane-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 2380 -s <etcd-peer-cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 2379 -j DROP
iptables -A INPUT -p tcp --dport 2380 -j DROP

# Verify etcd version after upgrade
etcd --version