Loading story…
Kubernetes v1.37 promotes etcd RangeStream to beta and enables the EtcdRangeStream feature gate by default. With etcd v3.7 or later, the kube-apiserver can consume large collection reads incrementally instead of requiring both etcd and the API server to retain an entire paginated response in memory.
The streamed-read path reduces and stabilizes memory usage during large list operations, lowering the risk of out-of-memory failures in control planes managing extensive resource collections. Clusters using older etcd releases remain supported through the existing paginated Range request path; administrators can confirm RangeStream activity through the listStream etcd operation metric or disable it explicitly through the feature gate.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Kubernetes v1.37 promoted the EtcdRangeStream feature gate to beta and enabled it by default. With etcd v3.7 or later, kube-apiserver can stream large collection reads in chunks to reduce memory pressure; it falls back to paginated Range reads with older or unsupported etcd servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kubernetes v1.37 promotes **Memory QoS** to beta and enables the `MemoryQoS` feature gate by default on kubelets. On Linux nodes using cgroup v2, the capability uses cgroup memory controls to influence kernel memory management for workloads, including controls such as `memory.high` and memory reservation mechanisms. The default `memoryThrottlingFactor` has changed from `0.9` to `null`, preventing upgrades from automatically applying `memory.high` throttling to existing workloads. Operators can explicitly enable throttling, configure node-wide tiered-memory reservations, or disable Memory QoS; Kubernetes cautions that TieredReservation applies to every pod on a node and that hard reservations may account for reclaimable page-cache memory.
Sep 14, 2026
Kubernetes 1.37 advances several platform-security controls, including rootless kubelet operation, short-lived service-account credentials for image pulls, authenticated API-server-to-webhook communication, and hardened volume-mount controls. The release also prohibits static Pods from referencing Secrets or ConfigMaps, while exposing additional API-visible operational and resource-health data that could aid reconnaissance where API permissions are overly broad. The release stabilizes SELinux mount labeling for eligible volumes, completing work initiated under KEP 1710 to mount volumes with the correct SELinux label rather than recursively relabeling every file at container startup. Administrators should test shared-volume labeling scenarios, adopt short-lived credentials, restrict API access, and verify that security tooling supports nftables as kube-proxy warns iptables users ahead of nftables becoming the default in Kubernetes 1.40.
Aug 29, 2026
etcd addressed **CVE-2026-73500**, a high-severity denial-of-service flaw in its TLS listener that let a remote attacker open large numbers of TCP connections and never complete the TLS `ClientHello`. In affected versions, `tlsListener.acceptLoop` spawned handshake goroutines without a deadline and retained them in a pending map, allowing unbounded goroutine and memory growth that could exhaust the etcd process and disrupt cluster availability, including Kubernetes control planes that depend on etcd. The fix adds a **10-second TLS handshake timeout** by setting a deadline before `Handshake()` and clearing it afterward, preventing stalled handshakes from blocking indefinitely. The change was merged upstream and backported across supported branches, with fixes released in **3.5.33**, **3.6.14**, and **3.7.1** through commits and pull requests on the main, `release-3.6`, and `release-3.5` branches; the issue is rated **CVSS 8.7** and mapped to **CWE-770**.
Aug 13, 2026