GO-2026-6107

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-6107
Import Source
https://vuln.go.dev/ID/GO-2026-6107.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2026-6107
Aliases
Downstream
Related
Published
2026-08-18T16:38:10Z
Modified
2026-08-19T21:41:59.273853582Z
Summary
Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3
Details

In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6107"
}
References
Credits
    • VMware By Broadcom

Affected packages

Go / go.etcd.io/etcd/client/pkg/v3

Package

Name
go.etcd.io/etcd/client/pkg/v3
View open source insights on deps.dev
Purl
pkg:golang/go.etcd.io/etcd/client/pkg/v3

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.5.33
Introduced
3.6.0
Fixed
3.6.14
Introduced
3.7.0-alpha.0
Fixed
3.7.1

Ecosystem specific 

{
    "imports": [
        {
            "path": "go.etcd.io/etcd/client/pkg/v3/transport",
            "symbols": [
                "NewListener",
                "NewListenerWithOpts",
                "NewTLSListener",
                "NewTimeoutListener",
                "tlsListener.acceptLoop"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-6107.json"