{"id":"GHSA-9gp7-6833-wv89","aliases":[],"status":"published","title":"etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery","description":"### Vulnerability type\nData Validation\n\n### Detail\nWhen an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery.\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-10-06T23:18:35Z","modified":"2023-01-12T05:05:04Z","fixes":[{"ecosystem":"Go","package":"go.etcd.io/etcd/client/v3","fixed_in":["3.4.10","3.3.23"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/client/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"go.etcd.io/etcd/client/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.23"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/client/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.10"}]}]},{"source":"osv","ecosystem":"Go","package":"go.etcd.io/etcd/client/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.23"}]}]}],"references":[{"url":"https://github.com/etcd-io/etcd/security/advisories/GHSA-9gp7-6833-wv89","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9gp7-6833-wv89"},{"url":"https://github.com/etcd-io/etcd","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-9gp7-6833-wv89","title":"etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery","description":"### Vulnerability type\nData Validation\n\n### Detail\nWhen an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery.\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)","status":"published","published":"2022-10-06T23:18:35Z","modified":"2023-01-12T05:05:04Z","updated_at":"2026-11-02T14:36:14.033357Z"}],"osv":[{"id":"GHSA-9gp7-6833-wv89","title":"etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery","description":"### Vulnerability type\nData Validation\n\n### Detail\nWhen an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery.\n\n### References\nFind out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)","status":"published","published":"2022-10-06T23:18:35Z","modified":"2022-10-06T23:18:35Z","updated_at":"2026-11-02T15:46:43.875515Z"}]}}