CVE-2018-1099: DNS Rebinding in etcd
Summary
CVE-2018-1099: DNS Rebinding in etcd. Affects go.etcd.io/etcd versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Also tracked for
- etcd · Debian:11
The same CVE-2018-1099 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
etcd is a distributed key-value store that provides a reliable way to store data across a cluster of machines. It is commonly used as a backend for distributed systems and container orchestration platforms. The vulnerability, identified as CVE-2018-1099, affects etcd versions 3.3.1 and earlier. It is a DNS rebinding vulnerability that allows an attacker to control DNS records and redirect requests to localhost or any other address. This can trick the browser into sending requests to the attacker-controlled address, potentially leading to unauthorized access or other malicious activities.
Vulnerability Detail
The DNS rebinding vulnerability in etcd arises from a lack of proper validation and enforcement of DNS resolution. By manipulating DNS records, an attacker can bypass the same-origin policy enforced by web browsers and trick them into sending requests to a malicious address. This can enable various attacks, such as accessing sensitive data, performing unauthorized actions, or launching further attacks against internal systems. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: v3.3.27+incompatible as of 22 Oct 2026
go get go.etcd.io/etcd@v3.3.27+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
go get go.etcd.io/etcd@v3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of etcd is not immediately feasible, a temporary workaround is to implement network-level protections against DNS rebinding attacks. This can be achieved by configuring firewalls or network devices to block or monitor DNS resolution requests to prevent unauthorized access to internal systems. However, applying the workaround is not a substitute for upgrading to the patched version, as it only mitigates the vulnerability to a certain extent.
Conclusion
The DNS rebinding vulnerability in etcd can be mitigated by upgrading to version 3.4.0 or later. It is important to promptly apply the fix to prevent potential unauthorized access or malicious activities. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for go.etcd.io/etcd →
FAQ
etcd is a distributed key-value store used for storing data across a cluster of machines. It is commonly used as a backend for distributed systems and container orchestration platforms.
DNS rebinding is an attack technique where an attacker manipulates DNS records to direct requests to a malicious address. This can bypass the same-origin policy enforced by web browsers and enable various attacks.
The vulnerability can allow an attacker to trick web browsers into sending requests to a malicious address, potentially leading to unauthorized access, data leakage, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to etcd version 3.4.0 or later. This version includes patches to prevent DNS rebinding attacks.
If immediate upgrading is not feasible, a temporary workaround is to implement network-level protections against DNS rebinding attacks, such as configuring firewalls or network devices to block or monitor DNS resolution requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for go.etcd.io/etcd.
