CVE-2020-15114 Denial of Service in etcd
Attackers can cause a denial of service in etcd gateway by configuring the gateway address as an endpoint, leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15114?
CVE-2020-15114 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 6 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.
Which versions are affected by CVE-2020-15114?
4 open source packages ship an affected version, including go.etcd.io/etcd. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
go.etcd.io/etcd Go | All versions | 3.3.23 |
go.etcd.io/etcd Go | All versions | 3.3.23 |
go.etcd.io/etcd Go | From 3.4.0-rc.0 | 3.4.10 |
go.etcd.io/etcd Go | From 3.4.0-rc.0 | 3.4.10 |
Products include Fedoraproject Fedora, Redhat Etcd.
How do I fix CVE-2020-15114?
Upgrade go.etcd.io/etcd to a fixed version for your release line: 3.3.23 or 3.4.10.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-15114 being exploited?
There is no known exploitation of CVE-2020-15114 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-6391, CLEANSTART-2025-GT80206, DEBIAN-CVE-2020-15114, GHSA-2xhq-gv6c-p224, UBUNTU-CVE-2020-15114.