etcd
v3.5.33Kubernetes CoreJul 23, 2026
etcd v3.5.33 is a security patch addressing a watch-permission bypass (GHSA-xg4h-6gfc-h4m8) where users with read access to a single key could receive watch events for all subsequent keys in the same prefix. The release also includes hardening fixes for unbounded reads on peer handlers, transaction cost accounting, slow-header DoS mitigation, and a data race in lease cache iteration.
securityWatch permission bypass (GHSA-xg4h-6gfc-h4m8)
A user granted read permission on a single key could receive watch event responses for every key starting from that key onward, bypassing intended permission boundaries. The fix ships in v3.5.33.
Key changes (6)
- Security: watch permission bypass fixed (GHSA-xg4h-6gfc-h4m8) – read permission on one key no longer leaks watch events for subsequent keys
- Unbounded io.ReadAll on peer lease HTTP handler body fixed to prevent excessive memory consumption from oversized requests
- costTxnReq function now correctly accounts for nested RequestTxn in cost calculation
- ReadHeaderTimeout added to client-facing HTTP server to mitigate slow-header attacks
- TLS handshake timeout added to tlsListener to bound connection setup duration
- Unsynchronized access in leaseCache.entries range operation fixed
Add etcd to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.