etcd: TCP connections that never send a ClientHello pile up goroutines until the process exhausts memory

Impact

Every connection accepted by tlsListener.acceptLoop in client/pkg/transport/listener_tls.go spawns a goroutine that blocks inside tls.Conn.Handshake() and stays in the pending map. An attacker who can reach the listener opens many TCP connections and never completes a handshake, so goroutines and map entries grow without bound until etcd runs out of memory. No certificate or credential is needed, because the abuse happens before the handshake that would check one. Where etcd backs Kubernetes, losing the etcd quorum takes the cluster control plane with it: no scheduling, no pod churn, no admission decisions, so GPU jobs that need to be placed or restarted stall even though running workloads keep their devices. Fixed in 3.5.33, 3.6.14 and 3.7.1.

Who can reach it

Anyone with TCP reachability to an etcd client or peer TLS listener. Unauthenticated - no client certificate or ClientHello required.

What to do

Upgrade etcd to 3.5.33, 3.6.14 or 3.7.1 and restart members one at a time so quorum is preserved; no node drain or reboot. Until patched, confirm the etcd listeners are reachable only from the control plane network and not from tenant or pod networks, and keep a connection-rate limit or firewall in front of them.

References

Related entries

• NGINX Ingress Controller: unsanitized Ingress annotations inject arbitrary NGINX directivesCVE-2026-77180 · NGINX Ingress Controller (Ingress annotation to nginx.conf generator)High
• Nuclio dashboard: namespace headers reach /bin/sh unquoted on the list-all path, unauthenticated RCECVE-2026-79756 · Nuclio dashboard (local/Docker platform, list-all resource path)High
• Docker Sandboxes: symlink race in the socket relay lets a guest reach arbitrary host AF_UNIX socketsCVE-2026-79994 · Docker Sandboxes (guest-to-host Unix-domain socket relay)High
• Coolify: shell metacharacters in env var keys give command execution on managed server hostsCVE-2026-84694 · Coolify (environment variable key names in Docker commands run over SSH)High
• NGINX Ingress Controller: spoofable forwarded headers bypass external authenticationCVE-2026-94197 · F5 NGINX Kubernetes Ingress Controller (ExternalAuth / auth_request subrequest)High
• runc: Host runc binary overwritten from inside a containerCVE-2019-5736 · runcHigh