{"id":"CVE-2020-15112","aliases":["AZL-6389","BIT-etcd-2020-15106","BIT-etcd-2020-15112","DEBIAN-CVE-2020-15112","EUVD-2022-7121","GHSA-m332-53r6-2w93","GHSA-p4g4-wgrh-qrg2","GO-2020-0005","RHSA-2021:0916","RHSA-2021:1407","SUSE-SU-2020:3760-1","SUSE-SU-2024:3656-1","UBUNTU-CVE-2020-15112","USN-5628-1","USN-5628-2"],"status":"published","title":"Improper Input Validation in etcd","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01256,"percentile":0.69729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129","CWE-20"],"published":"2020-08-05T19:15:10.903Z","modified":"2026-10-26T12:02:26Z","fixes":[{"ecosystem":"Go","package":"go.etcd.io/etcd/v3","fixed_in":["3.3.23","3.4.10"],"sources":["ghsa"]},{"ecosystem":"Azure Linux:2","package":"etcd","fixed_in":["3.5.0-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"etcd","fixed_in":["3.3.25+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"etcd","fixed_in":["3.3.25+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"etcd","fixed_in":["3.3.25+dfsg-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","fixed_in":["3.2.17+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"etcd","fixed_in":["3.2.26+dfsg-6ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.23"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.23"},{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.23"},{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.25+dfsg-5"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.23"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0-alpha.5.0.20200423152442-f4b650b51dc4"}]}],"bundled":2},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.5.0-alpha.5.0.20200423152442-f4b650b51dc4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-1.el8ost"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-1.el8ost"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"etcd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.23-1.el8ost"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.32-1.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"etcd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.32-1.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-4.21.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-150000.7.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.0+dfsg-2","2.2.1+dfsg-1","2.2.2+dfsg-1","2.2.2+dfsg-2","2.2.3+dfsg-1","2.2.5+dfsg-1","2.2.5+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-6ubuntu0.1"}]}],"versions":["3.2.26+dfsg-3","3.2.26+dfsg-4","3.2.26+dfsg-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.25+dfsg-6","3.3.25+dfsg-7","3.3.25+dfsg-7ubuntu0.22.04.1","3.3.25+dfsg-7ubuntu0.22.04.1+esm1","3.3.25+dfsg-7ubuntu0.22.04.2","3.3.25+dfsg-7ubuntu0.22.04.2+esm1","3.3.25+dfsg-7ubuntu0.22.04.2+esm2","3.3.25+dfsg-7ubuntu0.22.04.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.23-4ubuntu2","3.4.30-1","3.4.30-1build1","3.4.30-1ubuntu0.24.04.1","3.4.30-1ubuntu0.24.04.2","3.4.30-1ubuntu0.24.04.2+esm1","3.4.30-1ubuntu0.24.04.3","3.4.30-1ubuntu0.24.04.3+esm1","3.4.30-1ubuntu0.24.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-10","3.5.30-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.16-4","3.5.16-10","3.5.16-10ubuntu0.26.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.26+dfsg-6ubuntu0.1"}]}],"versions":["3.2.26+dfsg-3","3.2.26+dfsg-4","3.2.26+dfsg-6"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"etcd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.17+dfsg-1ubuntu0.1~esm1"}]}],"versions":["3.1.0-1","3.2.9+dfsg-2","3.2.9+dfsg-3","3.2.17+dfsg-1"],"bundled":4}],"products":[{"vendor":"etcd","product":"etcd"},{"vendor":"etcd-io","product":"etcd"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-m332-53r6-2w93","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15112","tags":["web","advisory"]},{"url":"https://github.com/etcd-io/etcd/commit/7d1cf640497cbcdfb932e619b13624112c7e3865","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/"},{"url":"https://github.com/etcd-io/etcd/pull/11793","tags":["web","fix"]},{"url":"https://github.com/etcd-io/etcd/commit/f4b650b51dc4a53a8700700dc12e1242ac56ba07","tags":["web","fix"]},{"url":"https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0005","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m332-53r6-2w93"},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2","tags":["advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15106","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15112","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP","tags":["web"]},{"url":"https://github.com/etcd-io/etcd/commit/4571e528f49625d3de3170f219a45c3b3d38c675","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0916","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868883","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0916.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15106","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15106","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15112","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15112","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15113","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15113","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15114","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15114","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15115","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15115","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-4993-m7g5-r9hh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15136","tags":["advisory"]},{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1407","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1407.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174219","tags":["report"]},{"url":"https://bugzilla.suse.com/1174951","tags":["report"]},{"url":"https://bugzilla.suse.com/1176752","tags":["report"]},{"url":"https://bugzilla.suse.com/1176753","tags":["report"]},{"url":"https://bugzilla.suse.com/1176754","tags":["report"]},{"url":"https://bugzilla.suse.com/1176755","tags":["report"]},{"url":"https://bugzilla.suse.com/1177661","tags":["report"]},{"url":"https://bugzilla.suse.com/1177662","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8566","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243656-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1095184","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121850","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1183703","tags":["report"]},{"url":"https://bugzilla.suse.com/1199031","tags":["report"]},{"url":"https://bugzilla.suse.com/1208270","tags":["report"]},{"url":"https://bugzilla.suse.com/1208297","tags":["report"]},{"url":"https://bugzilla.suse.com/1210138","tags":["report"]},{"url":"https://bugzilla.suse.com/1213229","tags":["report"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1217950","tags":["report"]},{"url":"https://bugzilla.suse.com/1218150","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-48795","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15112","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5628-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5628-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15106","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15114","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15112","title":"Improper Input Validation in etcd","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:00:15Z","modified":"2024-08-04T13:08:22.313Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2022-7121","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:00:15Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-m332-53r6-2w93","title":"etcd's WAL `ReadAll`  method vulnerable to an entry with large index causing panic","description":"### Vulnerability type\nData Validation\n\n### Detail\nIn the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md)","status":"published","published":"2022-10-06T23:03:57Z","modified":"2023-02-15T19:25:51Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20","CWE-129"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2020-15112","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:15:14.553Z","modified":"2026-06-17T02:56:04.637Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-129"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"AZL-6389","title":"CVE-2020-15112 affecting package etcd for versions less than 3.5.0-3","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:15:14Z","modified":"2026-04-21T04:32:14.808945Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CVE-2020-15106","description":"In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.","status":"published","published":"2020-08-05T19:15:10.903Z","modified":"2026-10-20T10:51:51.888437017Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"CVE-2020-15112","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:15:14.553Z","modified":"2026-10-20T10:51:51.973612112Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-15112","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:15:14.553Z","modified":"2026-10-26T12:02:26.642923603Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"GHSA-m332-53r6-2w93","title":"etcd's WAL `ReadAll`  method vulnerable to an entry with large index causing panic","description":"### Vulnerability type\nData Validation\n\n### Detail\nIn the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md)","status":"published","published":"2022-10-06T23:03:57Z","modified":"2026-09-10T03:49:49.732993941Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-129","CWE-20"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"GHSA-p4g4-wgrh-qrg2","title":"Panic due to malformed WALs in go.etcd.io/etcd","description":"### Vulnerability type\nData Validation\n\n### Detail\nThe size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.\n\n### Specific Go Packages Affected\ngithub.com/etcd-io/etcd/wal\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)","status":"published","published":"2023-02-07T22:59:30Z","modified":"2026-09-10T03:50:07.866746748Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"RHSA-2021:0916","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.4 (etcd) security update","status":"published","published":"2024-09-18T04:28:58Z","modified":"2026-06-27T10:13:05Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1407","title":"Red Hat Security Advisory: etcd security update","status":"published","published":"2024-09-18T04:29:05Z","modified":"2026-03-27T10:16:43.726912Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-15112","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2020-08-05T20:15:00Z","modified":"2026-10-17T12:55:44.783898648Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"BIT-etcd-2020-15106","title":"Improper Input Validation in etcd","description":"In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.","status":"published","published":"2024-03-06T10:52:40.894Z","modified":"2026-09-08T08:47:28.795573433Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"BIT-etcd-2020-15112","title":"Improper Input Validation in etcd","description":"In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.","status":"published","published":"2024-03-06T10:52:31.679Z","modified":"2026-09-08T08:47:31.878025974Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"GO-2020-0005","title":"Panic due to malformed WALs in go.etcd.io/etcd","description":"Malformed WALs can be constructed such that WAL.ReadAll can cause attempted out of bounds reads, or creation of arbitrarily sized slices, which may be used as a DoS vector.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T03:10:38.304879Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"SUSE-SU-2020:3760-1","title":"Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package","description":" = Required Actions\n\n== Kubernetes \u0026 etcd (Security fixes)\n\nThis fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_updating_kubernetes_components for the upgrade procedure.\n   \n== Skuba \u0026 helm/helm3\n\nIn order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_update_management_workstation\n\n= Known Issues\n\nModifying the file `/etc/sysconfig/kubelet` directly is not supported: documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscellaneous.html#_configuring_kubelet\n\nBe sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2_4 for any additional known issues or behavioral changes.","status":"published","published":"2020-12-23T08:18:56Z","modified":"2026-02-04T02:46:33.165107Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2024:3656-1","title":"Security update for etcd","description":"This update for etcd fixes the following issues:\n\nUpdate to version 3.5.12:\n\nSecurity fixes:\n\n- CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)\n- CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)\n- CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)\n- CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)\n- CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)\n- CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)\n- CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)\n- CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)\n- CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)\n- CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)\n\nOther changes:\n\n- Added hardening to systemd service(s) (bsc#1181400)\n- Fixed static /tmp file issue (bsc#1199031)\n- Fixed systemd service not starting (bsc#1183703)\n\nFull changelog:\n\nhttps://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12\n","status":"published","published":"2024-10-16T11:33:42Z","modified":"2026-02-04T02:49:49.268837Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-5628-1","title":"etcd vulnerabilities","description":"It was discovered that etcd incorrectly handled certain specially crafted\nWAL files. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2020-15106, CVE-2020-15112)\n\nIt was discovered that etcd incorrectly handled directory permissions when\ntrying to create a directory that exists already. An attacker could\npossibly use this issue to obtain sensitive information. (CVE-2020-15113)\n\nIt was discovered that etcd incorrectly handled endpoint setup. An\nattacker could possibly use this issue to cause a denial of\nservice. (CVE-2020-15114)\n","status":"published","published":"2022-09-22T13:38:55Z","modified":"2026-04-27T16:19:42.997638Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5628-2","title":"etcd vulnerabilities","description":"USN-5628-1 fixed vulnerabilities in etcd.\nThis update provides the corresponding updates for Ubuntu 18.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that etcd incorrectly handled certain specially crafted\n WAL files. An attacker could possibly use this issue to cause a denial of\n service. (CVE-2020-15106, CVE-2020-15112)\n\n It was discovered that etcd incorrectly handled directory permissions when\n trying to create a directory that exists already. An attacker could\n possibly use this issue to obtain sensitive information. (CVE-2020-15113)\n\n It was discovered that etcd incorrectly handled endpoint setup. An\n attacker could possibly use this issue to cause a denial of\n service. (CVE-2020-15114)\n","status":"published","published":"2022-09-22T15:16:34Z","modified":"2026-04-27T16:20:56.867583Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}