CVE-2020-15114

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-772

Affected software

Vendor	Product	Versions
etcd-io	etcd	< 3.3.23; < 3.4.10

References

Timeline

Published: Aug 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-151157.5etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those CVE-2020-151176.5In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xfff CVE-2020-151185.4In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` a CVE-2020-151195.4In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used CVE-2020-15127.8An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker w CVE-2020-151204.9In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without kno CVE-2020-151219.6In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required CVE-2020-151239.3In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library a CVE-2020-151246.5In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the CVE-2020-151257.7In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the CVE-2020-151266.5In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on CVE-2020-151277.5In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing