Loading story…
etcd addressed CVE-2026-73500, a high-severity denial-of-service flaw in its TLS listener that let a remote attacker open large numbers of TCP connections and never complete the TLS ClientHello. In affected versions, tlsListener.acceptLoop spawned handshake goroutines without a deadline and retained them in a pending map, allowing unbounded goroutine and memory growth that could exhaust the etcd process and disrupt cluster availability, including Kubernetes control planes that depend on etcd.
The fix adds a 10-second TLS handshake timeout by setting a deadline before Handshake() and clearing it afterward, preventing stalled handshakes from blocking indefinitely. The change was merged upstream and backported across supported branches, with fixes released in 3.5.33, 3.6.14, and 3.7.1 through commits and pull requests on the main, release-3.6, and release-3.5 branches; the issue is rated CVSS 8.7 and mapped to CWE-770.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-73500 was published for a high-severity denial-of-service vulnerability in etcd TLS listeners, where attackers could open many TCP connections and withhold the TLS ClientHello to cause unbounded goroutine and pending-map growth. The advisory states the issue is fixed in etcd 3.5.33, 3.6.14, and 3.7.1.
etcd committed the TLS handshake timeout change to the release-3.5 branch, adding the deadline around tlsConn.Handshake() in client/pkg/transport/listener_tls.go. The backport is associated with version v3.5.33 and reference #22160.
A backport commit for release-3.6 added the same 10-second tlsHandshakeTimeout to client/pkg/transport/listener_tls.go. The commit is associated with tag v3.6.14 and pull request #22142.
etcd merged pull request #22130 into the main branch, adding a 10-second timeout to tlsListener TLS handshakes to prevent handshake goroutines from blocking indefinitely. The pull request also referenced planned backports for release-3.7, release-3.6, and release-3.5.
GoVulnBot posted a potential vulnerability notice for go.etcd.io/etcd/v3, identifying GHSA-6vch-q96h-7gc3 in the project's vulnerability tracking workflow. This linked the timeout-related change to formal vulnerability handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity denial-of-service vulnerabilities in Erlang/OTP's **`ssl`** application allow unauthenticated remote attackers to disrupt secure listeners before authentication completes. **`CVE-2026-55950`** affects the DTLS **`dtls_packet_demux`** component, where a time-of-check/time-of-use race condition can be triggered by rapidly sending multiple DTLS `ClientHello` messages from the same source IP address and port. Because the demultiplexing process is shared across DTLS associations on a listener, a successful crash terminates **all active DTLS sessions** on that listener rather than only the attacker's connection. A second flaw, **`CVE-2026-55952`**, affects **TLS 1.3** servers when malformed `ClientHello` pre-shared key data causes session ticket handling to crash after the software fails to validate that PSK identity and binder lists are the same length. A single crafted request can make TLS 1.3 unusable on an affected listener until the **`ssl`** application is restarted, while TLS 1.2 is not affected. Erlang/OTP maintainers released fixes in **OTP `29.0.3`**, **`28.5.0.3`**, and **`27.3.4.14`**; the DTLS issue was addressed in a GitHub commit that changed logic in **`dtls_packet_demux.erl`** to safely handle existing keys during connection state transitions.
Jul 12, 2026
A critical vulnerability tracked as **`CVE-2026-55953`** affects Erlang/OTP SSL clients using **TLS 1.2 and earlier** as well as **DTLS**, allowing an on-path attacker to bypass server authentication and intercept supposedly secure sessions. The flaw occurs because the client does not verify that the cipher suite selected by the server was actually offered in the `ClientHello`, enabling an attacker to force an anonymous cipher suite and complete the handshake without certificate validation or hostname checking. Once the connection is established, the attacker can read and modify traffic; **TLS 1.3 is not affected** because it already performs the required cipher-suite membership check. The issue affects Erlang/OTP from **`OTP 17.0`** up to the patched releases **`27.3.4.15`**, **`28.5.0.4`**, and **`29.0.4`**, with corresponding SSL fixes in **`11.2.12.11`**, **`11.6.0.4`**, and **`11.7.4`**. Erlang/OTP maintainers addressed the bug in July with code changes to `ssl_handshake.erl` that add a pre-TLS 1.3 client cipher-suite validation check and trigger a fatal `illegal_parameter` alert if the negotiated suite was not advertised by the client. The vulnerability carries a **CVSS 4.0 score of 9.1** and is classified under **`CWE-757`**.
Jul 28, 2026
**CVE-2025-38684** is a moderate-severity flaw in the Linux kernel's Enhanced Transmission Selection (ETS) traffic-control scheduler. A faulty update sequence in `ets_qdisc_change()` updates `q->nbands` before unused DWRR classes are purged, leaving cleanup logic to operate on an inconsistent ETS configuration and potentially dereference a NULL pointer. A local attacker can trigger a kernel crash, resulting in denial of service; Red Hat rates the issue CVSS 5.2, while NVD assigns 5.5. Red Hat has released fixes for standard kernels in RHEL 8, RHEL 9, and RHEL 10. Fixes for the RHEL 8 and RHEL 9 real-time kernels remain deferred, while RHEL 6, RHEL 7, and the RHEL 7 real-time kernel are not affected because they lack the vulnerable code. Organizations using affected kernel packages should apply the available updates and plan mitigation for affected real-time deployments until fixes are released.
Aug 26, 2026