GHSA-6vch-q96h-7gc3

In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map e

High highest severity reported · also known as CVE-2026-73500, GO-2026-6107

1
catalog tools match this advisory
1
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
No
in the CISA KEV catalog
0.4%
EPSS for CVE-2026-73500, percentile 34

Catalog tools matching GHSA-6vch-q96h-7gc3

ToolVersion scannedPackageFixed inReleased binaryDeclared in or found inDispute
kyverno
Kubernetes Security
v1.19.2go.etcd.io/etcd/client/pkg/v3@v3.6.8
golang
3.5.33, 3.6.14, 3.7.1vulnerable code in binarygo.modDispute

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

GitHub advisory GHSA-6vch-q96h-7gc3 · NVD CVE-2026-73500 · Go vulnerability GO-2026-6107 · OSV GHSA-6vch-q96h-7gc3

Grype data sources: https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3