CVE-2020-15114: etcd-io etcd Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-15114 is a high (CVSS 7.7) Uncontrolled Resource Consumption vulnerability in etcd-io etcd. EPSS estimates a 1.13% chance of exploitation in the next 30 days, higher than 65.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 6Timeline
- 06-08-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- NVDNIST7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
1.13%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
-0.08 pp
From 1.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Affected systems
Chainguard4 products
- dgraph< 23.1.0-r6
- etcd-3.4< 3.4.36-r1
- etcd-3.4-iamguarded-compat< 3.4.36-r1
- etcd-fips-3.4< 3.4.36-r1
Debian1 product
- etcd< 3.3.25+dfsg-5
Etcd-io1 product
- etcd< 3.3.23 | < 3.4.10
Fedoraproject1 product
- fedoraEOL32
Go.etcd.io1 product
- etcd≥ 3.4.0-rc.0, < 3.4.10 | < 3.3.23
Redhat1 product
- etcd≥ 3.3.0, < 3.3.23 | ≥ 3.4.0, < 3.4.10
Ubuntu1 product
- etcdAll versions (No fix recorded) | < 3.2.17+dfsg-1ubuntu0.1~esm1 | < 3.2.26+dfsg-6ubuntu0.1
Wolfi1 product
- dgraph< 23.1.0-r6
8 vendors · 11 products
References
9 links- github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224X Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
