CVE-2026-73500

CVE-2026-73500 affects etcd. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can trigger the TLS handshake by opening many TCP connections. In tlsListener.acceptLoop, each connection handled by the loop spawns a goroutine that blocks indefinitely...

CVE-2026-73500 etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

GO-2026-5975 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions in github.com/SpectoLabs/hoverfly...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

PT-2026-60082

Name of the Vulnerable Software and Affected Versions Hoverfly version 1.12.7 Description Remote post-serve actions use http.DefaultClient without a timeout configuration. When a remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks...

Allocation of Resources Without Limits or Throttling

Overview github.com/gogs/gogs/internal/ssh is a painless self-hosted Git service Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the SSH handshake process. An attacker can exhaust available file descriptors and disrupt legitimate...

CoreDNS' DoQ worker pool does not bound stream backlog

Summary CoreDNS' DNS-over-QUIC DoQ server can be driven into large goroutine and memory growth by a remote client that opens many QUIC streams and stalls after sending only 1 byte. Even with a small configured quic workerpoolsize ... , CoreDNS still spawns a goroutine per accepted stream workers ...

CVE-2026-21720 Unauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time out

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine blocks forever trying to send on an unbuffered channel...

CVE-2026-21720

CVE-2026-21720 affects Grafana’s /avatar/:hash handling: each uncached request spawns a goroutine to refresh Gravatar, and if the refresh sits in a 10-slot worker queue longer than three seconds the handler times out, causing the goroutine to block on an unbuffered channel. This can lead to linea...

OESA-2025-2836 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

GO-2025-4108 containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd...

containerd CRI server: Host memory exhaustion through Attach goroutine leak

...

SUSE CVE-2025-64329

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

AZL-69976 CVE-2025-64329 affecting package moby-containerd-cc for versions less than 1.7.7-13

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

AZL-69739 CVE-2025-64329 affecting package containerd2 for versions less than 2.0.0-16

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

EUVD-2025-38219

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...

CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...