CVE-2020-15106

medium

Description

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

References

Advisories
More

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/

https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-0749

Details

Source: Mitre, NVD

Published: 2020-08-05

Updated: 2026-06-17

Named Vulnerability: GO-2020-0005Named Vulnerability: GHSA-p4g4-wgrh-qrg2Named Vulnerability: GHSA-m332-53r6-2w93

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity: Medium

EPSS

EPSS: 0.01291