GHSA-5x4g-q5rc-36jpLow▾ SunlitEtcd pkg Insecure ciphers are allowed by default
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
Cryptography
The TLS ciphers list supported by etcd contains insecure cipher suites. Users can configure the desired ciphers using the “--cipher-suites” flag, and a default list of secure cipher suites is used if empty.
By default, no action is required. If users want to specify cipher suites using the '--cipher-suites' flag, they should try not to specify insecure cipher suites. Please refer to the security documentation.
Find out more on this vulnerability in the security audit report
If you have any questions or comments about this advisory:
go.etcd.io/etcd/client/pkg/v3 >= 3.4.0-rc.0, < 3.4.10go.etcd.io/etcd/client/pkg/v3 < 3.3.23Upgrade to a patched release:
go.etcd.io/etcd/client/pkg/v3 3.4.10go.etcd.io/etcd/client/pkg/v3 3.3.23Connected by shared product, vendor, weakness, or advisory.
CVE-2020-15115Medium· 5.8etcd has no minimum password length
CVE-2026-73499Highetcd is a distributed key-value store for the data of a distributed system
CVE-2020-15106Medium· 5.3etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic
CVE-2020-15114High· 7.7Etcd Gateway can include itself as an endpoint resulting in resource exhaustion
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
GHSA-xg4h-6gfc-h4m8Highetcd: Watch API authorization bypass via open-ended range requests