CVE-2026-73500: 
HashiCorp Vault vulnerability analysis and mitigation

CVE-2026-73500 is a Denial of Service vulnerability in etcd, a distributed key-value store widely used as the backing store for Kubernetes. The flaw exists in the TLS listener implementation: a network attacker who can reach an etcd TLS listener can open many TCP connections without ever sending a TLS ClientHello message, causing unbounded goroutine and memory growth that exhausts the etcd process. Affected versions are etcd prior to 3.5.33, 3.6.0–3.6.13, and 3.7.0-alpha.0–3.7.0. It was published on August 12, 2026, with patches released by August 23, 2026. The CVSS v4.0 base score is 8.7 (High) (Feedly, Microsoft MSRC).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). In client/pkg/transport/listener_tls.go, the tlsListener.acceptLoop() function spawns a new goroutine for each accepted TCP connection and calls tls.Conn.Handshake(), which blocks indefinitely if the client never sends a ClientHello. Each stalled connection is also tracked in a pending map, so both goroutine count and map size grow without bound until the process runs out of memory. The fix, applied across all affected branches, introduces a 10-second tlsHandshakeTimeout by calling tlsConn.SetDeadline(time.Now().Add(tlsHandshakeTimeout)) before the handshake and clearing the deadline afterward (etcd commit 2e07efc, etcd commit 8e4dd06, etcd commit 89ff6d5, etcd commit f73cba7). No authentication is required; the attacker only needs network-level reachability to the etcd TLS port.

Successful exploitation causes memory exhaustion in the etcd process, resulting in a complete loss of availability for the etcd cluster. Because etcd is the primary data store for Kubernetes, a crashed etcd cluster renders the Kubernetes control plane unavailable, preventing scheduling, API server operations, and cluster management. There is no confidentiality or integrity impact — the attack is purely a Denial of Service (Feedly, Microsoft MSRC).

The vulnerability is automatable and requires no authentication or user interaction, making it straightforward for any network-adjacent attacker to trigger. The EPSS score is approximately 0.396%, reflecting a relatively low (but non-negligible) probability of exploitation in the wild. As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation; the CVE is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible etcd instances running a vulnerable version (< 3.5.33, 3.6.0–3.6.13, or 3.7.0-alpha.0–3.7.0) using network scanners such as Shodan, Censys, or nmap targeting the default etcd TLS port (2379/tcp).
2. Establish TCP connections: Using a scripted tool (e.g., a simple Python or Go script, or hping3), open a large number of TCP connections to the etcd TLS listener port without sending any TLS ClientHello data.
3. Sustain connections: Keep the TCP connections open (e.g., by not sending any data and not closing the socket), preventing the server from timing out the handshake in unpatched versions.
4. Resource exhaustion: Each open connection causes etcd to spawn a goroutine blocked in tls.Conn.Handshake() and add an entry to the pending map. Repeating this at scale exhausts available memory in the etcd process.
5. Cluster crash: Once memory is exhausted, the etcd process crashes or becomes unresponsive, taking down the etcd cluster and, if backing Kubernetes, the control plane (etcd commit 2e07efc, Feedly).

• Network: Unusually high number of TCP connections to etcd TLS port (default 2379/tcp) from one or more source IPs that never progress to TLS handshake completion; connections remaining in SYN_RECV or ESTABLISHED state with no data exchanged.
• Process: Rapidly increasing goroutine count in etcd process metrics (e.g., go_goroutines Prometheus metric spiking); etcd process memory (process_resident_memory_bytes) growing unboundedly without corresponding increase in stored data.
• Logs: etcd logs showing a large number of pending TLS handshake entries; OOM-killer events in system logs (dmesg or /var/log/syslog) referencing the etcd process; Kubernetes API server errors indicating etcd unavailability.
• System: Sudden etcd process crash or restart; Kubernetes control plane components (kube-apiserver, kube-scheduler, kube-controller-manager) reporting etcd connection failures.

Upgrade etcd to the patched versions: 3.5.33, 3.6.14, or 3.7.1. The fix introduces a 10-second TLS handshake timeout (tlsHandshakeTimeout = 10 * time.Second) applied via SetDeadline on each accepted connection, preventing goroutine and memory leaks from stalled handshakes (etcd commit 2e07efc). As interim mitigations, restrict network access to etcd TLS listeners to trusted clients only using firewall rules or network policies, and implement connection rate limiting at the network level on the etcd TLS port to reduce the impact of connection flooding (Feedly). Microsoft has also released updated Azure Linux 3 packages for affected components (Microsoft MSRC).