CVE-2026-73500
HighAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.004
- 33rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 586
- of 17,787 indexed, latest versions
- Container images
- 552
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Carried by container images the latest versions of 586 of 17,787 indexed charts deploy, on 552 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| etcdbitnami | 3.5.7-0, 3.6.1-1, 3.6.4-0 | 3.5.33 | 4 |
| go.etcd.io/ | v3.3.0-rc.0.0.20200707003333-58bb8ae09f8e | 3.5.33 | 4 |
| go.etcd.io/ | v3.0.0-20210928084031-3df272774672, v3.5.0, v3.5.1, v3.5.2+33 more | 3.5.33 | 544 |
Charts affected
586 by stars
Container images carrying it
552 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| minio/ | d249d1fb6966 | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | e2b7b633c250 | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | f9576903f19d | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | fc6bedc99355 | go.etcd.io/ | 3.5.33 | 1 |
| minio/ | 170b154d2c61 | go.etcd.io/ | 3.5.33 | 1 |
| nerzhul/ | 4215df511f31 | go.etcd.io/ | 3.5.33 | 1 |
| nginx/ | 520d439f9a9a | go.etcd.io/ | 3.5.33 | 1 |
| nginx/ | 8ca7b42ae702 | go.etcd.io/ | 3.5.33 | 1 |
| oamdev/ | 1bcae00bd7b0 | go.etcd.io/ | 3.5.33 | 1 |
| okteto/ | 57cd51176538 | go.etcd.io/ | 3.5.33 | 1 |
| opencloudeu/ | 6d992ccc5f1c | go.etcd.io/ | 3.5.33 | 1 |
| openkruise/ | 0482722b4e56 | go.etcd.io/ | 3.5.33 | 1 |
| openkruise/ | f81ae78a36a4 | go.etcd.io/ | 3.5.33 | 1 |
| openmined/ | 3a4144c0bb82 | go.etcd.io/ | 3.5.33 | 1 |
| opennms/ | 88869082a14f | go.etcd.io/ | 3.5.33 | 1 |
| otel/ | dfb3a55ea8c9 | go.etcd.io/ | 3.5.33 | 1 |
| owncloud/ | 88e7c854517d | go.etcd.io/ | 3.5.33 | 1 |
| owncloud/ | b38fd8fdd58f | go.etcd.io/ | 3.5.33 | 1 |
| percona/ | 003f9c25f842 | go.etcd.io/ | 3.5.33 | 1 |
| persesdev/ | a0e34ddaf9d7 | go.etcd.io/ | 3.5.33 | 1 |
| pgsharding/ | 4734940216d3 | go.etcd.io/ | 3.5.33 | 1 |
| phntom/ | 53883b65d9b7 | go.etcd.io/ | 3.5.33 | 1 |
| phntom/ | 9242b4df9e65 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | 7f45198aac99 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | 199961f11ba6 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | febfd0517838 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | fe417c28a6b8 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | 41cb674d1154 | go.etcd.io/ | 3.5.33 | 1 |
| rancher/ | 1975fac3890f | go.etcd.io/ | 3.5.33 | 1 |
| redislabs/ | 9078e713bb6a | go.etcd.io/ | 3.5.33 | 1 |
| rotationalio/ | cc7bb030a20f | go.etcd.io/ | 3.5.33 | 1 |
| rqlite/ | 7b992a526eee | go.etcd.io/ | 3.5.33 | 1 |
| sarwansharma/ | 59d1da9385d1 | go.etcd.io/ | 3.5.33 | 1 |
| scaleway/ | 6d94c970e710 | go.etcd.io/ | 3.5.33 | 1 |
| sigma2as/ | c284ead9ec3e | go.etcd.io/ | 3.5.33 | 1 |
| sky5367/ | d51bf68d4b26 | go.etcd.io/ | 3.5.33 | 1 |
| streamnative/ | 31533fa9fab7 | go.etcd.io/ | 3.5.33 | 1 |
| su541/ | 371ee33f83c1 | go.etcd.io/ | 3.5.33 | 1 |
| svtechnmaa/ | 6e368ace0977 | go.etcd.io/ | 3.5.33 | 1 |
| thesisrobot/ | 287129953689 | go.etcd.io/ | 3.5.33 | 1 |
| thmmniii/ | 86105349c1a3 | go.etcd.io/ | 3.5.33 | 1 |
| traefik/ | acc7fcca5f1c | go.etcd.io/ | 3.5.33 | 1 |
| wavefronthq/ | af5fef9a4768 | go.etcd.io/ | 3.5.33 | 1 |
| zachomedia/ | 4940e227a39b | go.etcd.io/ | 3.5.33 | 1 |
| gcr.io/ | 6937c0a9b203 | go.etcd.io/ | 3.5.33 | 1 |
| gcr.io/ | e5acd40c5aa5 | go.etcd.io/ | 3.5.33 | 1 |
| gcr.io/ | dbbec053774e | go.etcd.io/ | 3.5.33 | 1 |
| gcr.io/ | 9388835ed097 | go.etcd.io/ | 3.5.33 | 1 |
| gcr.io/ | 4a2438d399ff | go.etcd.io/ | 3.5.33 | 1 |
| ghcr.io/ | 8ec6c4812a7e | go.etcd.io/ | 3.5.33 | 1 |