The vulnerability in etcd's tlsListener.acceptLoop occurs because each incoming TCP connection to the TLS listener spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() if the client never sends a ClientHello message. These goroutines accumulate without bound, tracked in a pending map, leading to unbounded memory consumption and eventual denial of service. This affects etcd versions prior to 3.6.14 (for 3.6.x), prior to 3.5.33 (for 3.5.x), and versions before 3.7.1. The vulnerability allows unauthenticated network attackers to exhaust server resources by opening many incomplete TLS connections. The issue is patched in the specified fixed versions.

An unauthenticated network attacker who can reach the etcd TLS listener can cause a denial of service by exhausting memory resources on the etcd server. This results in loss of availability for the etcd cluster and any systems relying on it, such as Kubernetes control planes. There are no indications of data compromise or privilege escalation, but availability impact is high.

This vulnerability is patched in etcd versions 3.7.1, 3.6.14, and 3.5.33. Users should upgrade to these or later versions to remediate the issue. If immediate upgrade is not possible, restrict network access to the etcd client (gRPC) port using firewall rules or network policies to limit which hosts can connect, thereby reducing the risk of exploitation.