CVE-2020-15106Medium· 5.3▾ Sunlitetcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.3%
Data Validation
In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Find out more on this vulnerability in the security audit report
If you have any questions or comments about this advisory:
go.etcd.io/etcd/v3 < 3.3.23go.etcd.io/etcd/v3 >= 3.4.0, < 3.4.10Upgrade to a patched release:
go.etcd.io/etcd/v3 3.3.23go.etcd.io/etcd/v3 3.4.10Connected by shared product, vendor, weakness, or advisory.
CVE-2020-15115Medium· 5.8etcd has no minimum password length
CVE-2026-73499Highetcd is a distributed key-value store for the data of a distributed system
GHSA-5x4g-q5rc-36jpLowEtcd pkg Insecure ciphers are allowed by default
CVE-2020-15114High· 7.7Etcd Gateway can include itself as an endpoint resulting in resource exhaustion
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
GHSA-xg4h-6gfc-h4m8Highetcd: Watch API authorization bypass via open-ended range requests