{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/etcd-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["etcd (\u003c 3.5.33)","etcd (\u003e= 3.6.0, \u003c 3.6.14)","etcd (\u003e= 3.7.0-alpha.0, \u003c 3.7.1)"],"_cs_severities":["medium"],"_cs_tags":["etcd","denial-of-service","kubernetes","TLS"],"_cs_type":"advisory","_cs_vendors":["etcd project"],"content_html":"\u003cp\u003eA critical denial-of-service vulnerability (GHSA-6vch-q96h-7gc3) exists in etcd's TLS listener, allowing a remote network attacker to render etcd clusters unavailable. This flaw, discovered and reported by VMware By Broadcom, affects etcd versions prior to 3.5.33, 3.6.0 through 3.6.13, and 3.7.0-alpha.0 through 3.7.0. The vulnerability stems from etcd's \u003ccode\u003etlsListener.acceptLoop\u003c/code\u003e component, which spawns an unbounded number of goroutines when handling incoming TCP connections that do not proceed with a TLS ClientHello message. Each uncompleted handshake consumes server memory indefinitely, leading to memory exhaustion and subsequent denial of service for the etcd process. This directly impacts the availability of etcd-backed services, most notably the control plane for Kubernetes deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA network attacker establishes numerous TCP connections to a vulnerable etcd TLS listener on the target server.\u003c/li\u003e\n\u003cli\u003eThe attacker intentionally refrains from sending the expected TLS ClientHello message after initial TCP connection establishment for each new connection.\u003c/li\u003e\n\u003cli\u003eFor every incoming TCP connection, the etcd server's \u003ccode\u003etlsListener.acceptLoop\u003c/code\u003e component spawns a dedicated goroutine to manage the TLS handshake.\u003c/li\u003e\n\u003cli\u003eEach spawned goroutine attempts to perform a TLS handshake and consequently enters a blocking state within \u003ccode\u003etls.Conn.Handshake()\u003c/code\u003e, waiting indefinitely for the absent ClientHello message.\u003c/li\u003e\n\u003cli\u003eThe etcd process's internal pending map tracks these blocked goroutines and their associated connection states, leading to an uncontrolled increase in entries.\u003c/li\u003e\n\u003cli\u003eAs the attacker maintains open, incomplete connections, the number of blocked goroutines and the size of the internal pending map grow without bound.\u003c/li\u003e\n\u003cli\u003eThis uncontrolled growth continuously consumes increasing amounts of memory within the etcd server process, eventually leading to memory exhaustion.\u003c/li\u003e\n\u003cli\u003eThe etcd server process crashes or becomes unresponsive, resulting in a denial of service for the etcd cluster and its dependent services, such as a Kubernetes control plane.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a complete loss of availability for the targeted etcd cluster due to memory exhaustion and subsequent process crashes. Organizations using affected etcd versions, particularly those relying on etcd as the backend for their Kubernetes control planes, are at risk. A denial of service for etcd directly impacts the operational status and management capabilities of Kubernetes, potentially rendering clusters inoperable until the etcd instance is restored or patched. There are no specific victim counts or sectors mentioned, but any organization using etcd is potentially vulnerable.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade etcd to a patched version immediately to remediate the vulnerability (etcd 3.7.1, 3.6.14, or 3.5.33).\u003c/li\u003e\n\u003cli\u003eRestrict network access to etcd's client (gRPC) port for vulnerable versions using firewall rules or network policy to limit potential attackers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T22:43:21Z","date_published":"2026-07-24T22:43:21Z","id":"https://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/","summary":"A denial-of-service vulnerability in etcd's TLS listener allows a network attacker to exhaust server memory by spawning unbounded goroutines through multiple TCP connections without sending ClientHello messages, leading to loss of availability for etcd clusters and dependent services like Kubernetes.","title":"etcd TLS Listener Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-etcd-tls-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Etcd Project","version":"https://jsonfeed.org/version/1.1"}