Is go.etcd.io/etcd/v3 safe to use?

Vulert records 15 vulnerabilities for go.etcd.io/etcd/v3 in Go: 1 critical, 6 high, 3 medium and 5 low. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is go.etcd.io/etcd/v3's Vulert package health score?

Vulert scores go.etcd.io/etcd/v3 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of go.etcd.io/etcd/v3 affected?

Yes. v3.7.3, the version you would install today, has 5 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does go.etcd.io/etcd/v3 have?

15 vulnerabilities are recorded for go.etcd.io/etcd/v3 in the Go ecosystem: 1 critical, 6 high, 3 medium and 5 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new go.etcd.io/etcd/v3 vulnerabilities disclosed?

5 vulnerabilities were recorded for go.etcd.io/etcd/v3 in the last 12 months, and the oldest entry in this database dates to 15 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of go.etcd.io/etcd/v3 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor go.etcd.io/etcd/v3 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at https://vulert.com/scanner and Vulert keeps checking the go.etcd.io/etcd/v3 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.

Vulnerability Database · Go · Package report

go.etcd.io/etcd/v3: vulnerability history, versions and safety

go.etcd.io/etcd/v3 is a package in the Go ecosystem. Vulert records 15 vulnerabilities for it across 120 releases, from Feb 2022 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

15 vulnerabilities recorded C1 H6 M3 L5

1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →

5 in the last 12 months

Most recent disclosure 24 Jul 2026.

See the disclosure history →

0 malicious-package vulnerabilities

No published version shipped hostile code.

See all go.etcd.io/etcd/v3 vulnerabilities

Vulert verdict on go.etcd.io/etcd/v3 v3.7.3 i

Updated on 23 Oct 2026

Careful: v3.7.3 has 5 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100

Security Some issues to review
Maintenance Sustainable
Popularity Key ecosystem project
Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

Current release v3.7.3 — affected i
Vulnerabilities on record 15 over 4 years · 5 in the last year i
Latest disclosure 24 Jul 2026 i
Highest CVSS 9.8 i
With no published fix 1 i
Stars 52,411 i
OpenSSF scorecard 6/10 i
Last release this month i
Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

Scan your app free →

01 Versions

Which versions are affected

Every version Vulert tracks for go.etcd.io/etcd/v3, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

Version	Released	Vulert vulnerabilities	Licence	Fix published	Details
v3.7.3	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.16	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261022220034-32e390025bed	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.35	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261022202008-8ec1aac52006	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261022175611-4ffb2c0d1731	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261022132243-91f4ff21defb	22 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261021130820-bf9cadf044f0	21 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261020233303-7ff040cb84c9	20 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261019133827-6782f5229b8a	19 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261018125445-22cc5d9acd4a	18 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261017193155-0155117751ed	17 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261016211228-b25719d10cdc	16 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261013142537-d3c8a1559092	13 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261012201554-a2b3d9fe8643	12 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20261008093133-f061acd0902d	08 Oct 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260925154347-7583cc6e7e27	25 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260924060513-1edd247ff4b4	24 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260923125534-b147d754ff7e	23 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.35-0.20260923083807-dc759e11f818	23 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.2	22 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.15	22 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.34	22 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260921194636-d8a03ef08fb9	21 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0-alpha.0.0.20260920203146-53363b51bd47	20 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260920203146-53363b51bd47	20 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260918085316-5ef5d3c26b40	18 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260916180307-f094b9834a5a	16 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260911205001-9ba96c87c013	11 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.34-0.20260911173313-2e9f2b59bf1c	11 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260908143937-fd8581e0490e	08 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260907081544-d848b43ae106	07 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260903173245-e9e56564d6f1	03 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260901034609-b655785b1e43	01 Sep 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260831210711-01c11c404320	31 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260827210026-774da656e202	27 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.34-0.20260823202915-58fa9ae1a918	23 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260823202749-24c71d74f58a	23 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260819124516-7b2ad21ddd2b	19 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260818211500-80dfedef534a	18 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260815204739-00a7653ca9dc	15 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260815072049-f744d457f484	15 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.34-0.20260815072025-bce5895a9b94	15 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260814201433-fb09d058cd82	14 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260813085348-0836b69e9cf4	13 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260812084353-faafe775bdee	12 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.0.0-20260809100330-ee043b39e175	09 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260809100330-ee043b39e175	09 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260806203346-5b75ac62cf04	06 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260805144902-7d7f884852f7	05 Aug 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260731195311-a279d15ac644	31 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260730084941-c1dc77f1da85	30 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.34-0.20260729160636-b20d5915a6f5	29 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260728210555-1e9f0c8c36cd	28 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260728201105-097f74206fd0	28 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260727071935-0b799900a433	27 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260724083803-3e3b4c181c69	24 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.1	23 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.14	23 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.33	23 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260723141240-14bd0caac423	23 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.32-0.20260722082756-fafe75628c3c	22 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.33-0.20260722082756-fafe75628c3c	22 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.1-0.20260721204506-2e07efce9745	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.13-0.20260721201846-5f12ec3a0b1b	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.14-0.20260721201846-5f12ec3a0b1b	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.1-0.20260721201846-7a4b47bcba71	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260721091647-8e4dd0679a2c	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260721083937-81e09b024dbd	21 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260714181352-6006f4058009	14 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260710182410-12caed621b38	10 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.14-0.20260710142819-724eb1986438	10 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.33-0.20260710140304-fb7d7a3fbecc	10 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.0.0-20260710125858-7cf71ec9e2ec	10 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0	08 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260708164649-d6ff4aa8a308	08 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260702172623-b9ba05c8ec9a	02 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.13	01 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.32	01 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260701155313-f7b23bbd3c61	01 Jul 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260629204340-1cc34386eed9	29 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260624095526-5f6496ad4b0a	24 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260623084937-2c40e7758f1e	23 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260622113139-6c84057b0e38	22 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260619115854-61d518f55eff	19 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260618011451-f5641854d26c	18 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260616133934-8bd9509445c0	16 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.32-0.20260615140806-7b9b779288c1	15 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260612152938-22d55b52acba	12 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260612104129-9fe8452c3a33	12 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260608090513-5ee062d7a5fd	08 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260605220549-74aba8cb827f	05 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0.0.20260605092252-038d4c1085a1	05 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.8.0-alpha.0	05 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.32-0.20260604162031-3a9e888fefbb	04 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0-beta.0.0.20260603130242-d441996d0ab9	03 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0-rc.0	01 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.6.12	01 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.5.31	01 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0-beta.0.0.20260601083015-9ed485d3e37b	01 Jun 2026	C1 H2 M2	Apache-2.0	No	Details →
v3.7.0-beta.0.0.20260525080202-8ad92a0dc801	25 May 2026	C1 H2 M2	—	No	Details →
v3.7.0-beta.0.0.20260523193037-dde11c0d4cd3	23 May 2026	C1 H2 M2	—	No	Details →
v3.7.0-beta.0.0.20260519191518-d5527f23efe5	19 May 2026	C1 H2 M2	—	No	Details →
v3.7.0-beta.0	19 May 2026	C1 H2 M2	—	No	Details →
v3.7.0-alpha.0.0.20260513114709-9c420dfa0eb7	13 May 2026	C1 H2 M2	—	No	Details →
v3.5.31-0.20260511185827-c7f74b60b686	11 May 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260506150449-0cbc031e7f22	06 May 2026	C1 H2 M2	—	No	Details →
v3.6.11	01 May 2026	C1 H2 M2	—	No	Details →
v3.5.30	01 May 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260501165119-2bc66e486400	01 May 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260420205548-8687c97fa5fc	20 Apr 2026	C1 H2 M2	—	No	Details →
v3.6.10	01 Apr 2026	C1 H2 M2	—	No	Details →
v3.5.29	01 Apr 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260331142858-6a4e69bb85c4	31 Mar 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260329195729-984e022120b5	29 Mar 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260324131647-8dfd8288b27e	24 Mar 2026	C1 H2 M2	—	No	Details →
v3.6.9	20 Mar 2026	C1 H2 M2	—	No	Details →
v3.5.28	20 Mar 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260320114629-e2f959f51c8d	20 Mar 2026	C1 H2 M2	—	No	Details →
v3.6.0-alpha.0.0.20260319184657-5791f2b80ecf	19 Mar 2026	C1 H2 M2	—	No	Details →

The newest 120 of 3,882 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

2022 5
2023 2
2024 3
2026 5

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 5 of the 15 were recorded in the last 12 months.

Other ways into the data

03 Vulnerabilities

Recorded vulnerabilities for go.etcd.io/etcd/v3

Vulnerability	Severity	Fixed version ↓	Disclosed ↓
CVE-2021-28235: Etcd-io Improper Authentication Vulnerability	9.8 critical	No fix published	04 Apr 2023
CVE-2026-33413: etcd Authorization Bypass Vulnerabilities in Multiple APIs	8.8 high	3.6.9	20 Mar 2026
CVE-2018-1098: Cross-site Request Forgery (CSRF) in go.etcd.io/etcd/v3/etcdserver	8.8 high	3.4.0	15 Feb 2022
Unbounded Handshake Goroutines in etcd: A Critical Memory Exhaustion Vulnerability	8.7 high	3.7.1	24 Jul 2026
CVE-2018-16886: Improper Authentication in etcd	8.1 high	3.2.26	12 Apr 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315