CVE-2026-73500
HighAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.004
- 33rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 586
- of 17,787 indexed, latest versions
- Container images
- 552
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Carried by container images the latest versions of 586 of 17,787 indexed charts deploy, on 552 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| etcdbitnami | 3.5.7-0, 3.6.1-1, 3.6.4-0 | 3.5.33 | 4 |
| go.etcd.io/ | v3.3.0-rc.0.0.20200707003333-58bb8ae09f8e | 3.5.33 | 4 |
| go.etcd.io/ | v3.0.0-20210928084031-3df272774672, v3.5.0, v3.5.1, v3.5.2+33 more | 3.5.33 | 544 |
Charts affected
586 by stars
Container images carrying it
552 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 3af8698e0524 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 7b67df066352 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 8b41a7c5f1bf | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 1543e1b67da2 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | aeab520e775b | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 71c4fb311763 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 90c78c240157 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 50e8541200ae | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | fca606eb53eb | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | fdfffa3984a5 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 125e31c8e85a | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 50fb24449dc3 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 6819b34ccac8 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 3a98245a7667 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 759f3850eda9 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | e9bde36e34b7 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 7d4a5e29c387 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 9f157fe035f1 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 70548dbe0c6a | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 322f5f8cc105 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | a2523c532c0c | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 13fd0cccafe8 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 23f4da194134 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | b92123805584 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 4964ceaf9d35 | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 21715979aefa | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | a7a846bba3e8 | go.etcd.io/ | 3.5.33 | 1 |
| mcr.microsoft.com/ | 16987358befc | go.etcd.io/ | 3.5.33 | 1 |
| mcr.microsoft.com/ | 557008207ca4 | go.etcd.io/ | 3.5.33 | 1 |
| mcr.microsoft.com/ | 8b3ce8339944 | go.etcd.io/ | 3.5.33 | 1 |
| public.ecr.aws/ | e7e1db003e6a | go.etcd.io/ | 3.5.33 | 1 |
| public.ecr.aws/ | ee9d973e3952 | go.etcd.io/ | 3.5.33 | 1 |
| public.ecr.aws/ | 783d550ad813 | go.etcd.io/ | 3.5.33 | 1 |
| public.ecr.aws/ | 08c90bd040bf | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 2c7b120590cb | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 2c8f8c357ff8 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 754ab2a723c8 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | f5fbfec6a2b2 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 351d6685dc6f | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 858f807ea4e2 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | cdcfab5b4466 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 6079308ee15e | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 773886ec9337 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 819c7281f5a4 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | cb4e4ffc5789 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 96fac2482898 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 13aaae779248 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 8577eb292a01 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | 2804aabd76d2 | go.etcd.io/ | 3.5.33 | 1 |
| quay.io/ | b741efae8d31 | go.etcd.io/ | 3.5.33 | 1 |