CVE-2020-15114

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

• CWE-400
• CWE-772

• https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
• https://github.com/etcd-io/etcd/security/advisories/GHSA-2xhq-gv6c-p224Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/

Published

Aug 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
• CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
• CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
• CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5
• CVE-2020-15113In etcd before versions 3.3.23 and 3.4.10, certain directory…7.1
• CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
• CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
• CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
• CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
• CVE-2020-1512An information disclosure vulnerability exists when the Wind…7.8
• CVE-2020-15120In "I hate money" before version 4.1.5, an authenticated mem…4.9