[Medium] Patch etcd for CVE-2026-33814#17434
Conversation
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
mfrw
left a comment
mfrw
left a comment
There was a problem hiding this comment.
LGTM ✅ — patch verified against upstream and the etcd build itself is green on both archs.
Patch verification: matches upstream golang/net 1e71bd8 — move the s.Valid() call from inside the SettingEnableConnectProtocol case to the top of the ForeachSetting callback. Path prefix (vendor/golang.org/x/net/http2/) and ±4-line offsets differ from upstream because etcd vendors a slightly older snapshot; the hunks themselves are byte-identical. Omitting the upstream http2/transport_test.go is correct since _test.go files aren't shipped in the vendored copy (as noted in the PR description).
Build / CI on buildId=1125645:
| Stage | AMD64 | ARM64 |
|---|---|---|
Toolchain |
✅ succeeded | ✅ succeeded |
Toolchain_tests |
✅ succeeded | ✅ succeeded |
Build packages (incl. etcd-3.5.30-2.azl3.{src,x86_64,aarch64}.rpm) |
✅ succeeded | ✅ succeeded |
Verify all tests passed |
❌ failed | ❌ failed |
The Verify all tests passed reds are unrelated to this change — I checked the failing test runs and none of them touch etcd or http2:
- AKS Testing (
Mariner AKS Testing on ubuntu/on mariner-custom):Cluster Creation Failed in ~1300–1500s,Expected 3 ready nodes, found 2,Cluster Scale Up took 276s (threshold 270s). Azure-side cluster-provisioning flake / marginal timing. - Package-Test: ~20–24 failures across unrelated packages (
libxslt,binutils,nlohmann-json,perl,zchunk,systemd,ostree,nfs-utils,meson,qemu-kvm,c-ares,dnf,ansible,python-pip,python-cryptography,python-setuptools,softhsm,gd, …). Looks like broad CI infrastructure breakage on this run.
@Ratiranjan5 — could you re-trigger the failed stages? The etcd RPM itself builds and packages cleanly on both archs.
Signed-Off By: @mfrw
| @@ -0,0 +1,42 @@ | |||
| From 7e9e82f8c3033974b16d93835521f6e133a7c9aa Mon Sep 17 00:00:00 2001 | |||
There was a problem hiding this comment.
Patch looks good w.r.t upstream.
The single vendor/golang.org/x/net/http2/transport.go hunk matches upstream golang/net 1e71bd8 — same move of the s.Valid() call from inside the SettingEnableConnectProtocol case to the top of the ForeachSetting callback. ✓
Omitting the upstream http2/transport_test.go hunk is fine — that file isn't shipped in the vendored snapshot.
| @@ -3,7 +3,7 @@ | |||
| Summary: A highly-available key value store for shared configuration | |||
There was a problem hiding this comment.
Release bump, Patch1 declaration and changelog entry look good.
Non-blocking observation: PATCH1 is applied to all 5 components (server, etcdctl, etcdutl, tools/etcd-dump-db, tools/etcd-dump-logs), whereas the existing PATCH0 (CVE-2026-29181) is only applied to the first three. The Build packages task succeeded on both archs so the tools' vendor tarballs do contain vendor/golang.org/x/net/http2/transport.go — this PR's broader coverage looks correct. Worth keeping in mind for any future re-issue of CVE-2026-29181.
🔒 CVE Patch Review: CVE-2026-33814PR #17434 — [Medium] Patch etcd for CVE-2026-33814 Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log AnalysisNo test log found (package may not have a %check section). Patch Analysis
Detailed analysis
Conclusion: The PR is a faithful backport of the upstream security fix to the vendored x/net/http2 code, with only the test hunk omitted. Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,68 +1,48 @@
-From 1e71bd86e4a302b4e731bc06da6eb51679c7bd49 Mon Sep 17 00:00:00 2001
-From: "Nicholas S. Husin" <nsh@golang.org>
-Date: Tue, 31 Mar 2026 15:15:30 -0400
-Subject: [PATCH] http2: prevent hanging Transport due to bad SETTINGS frame
-
-This CL backports https://go.dev/cl/761581 to x/net.
-
-Fixes golang/go#78476
-Fixes CVE-2026-33814
-
-Change-Id: Ied435a51fdd8664d41dae14d082c39c76a6a6964
-Reviewed-on: https://go-review.googlesource.com/c/net/+/761640
-LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
-Reviewed-by: Nicholas Husin <husin@google.com>
-Reviewed-by: Damien Neil <dneil@google.com>
----
- http2/transport.go | 6 +++---
- http2/transport_test.go | 13 +++++++++++++
- 2 files changed, 16 insertions(+), 3 deletions(-)
-
-diff --git a/http2/transport.go b/http2/transport.go
-index 2e9c2f6a52..8132233310 100644
---- a/http2/transport.go
-+++ b/http2/transport.go
-@@ -2861,6 +2861,9 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
-
- var seenMaxConcurrentStreams bool
- err := f.ForeachSetting(func(s Setting) error {
-+ if err := s.Valid(); err != nil {
-+ return err
-+ }
- switch s.ID {
- case SettingMaxFrameSize:
- cc.maxFrameSize = s.Val
-@@ -2892,9 +2895,6 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
- cc.henc.SetMaxDynamicTableSize(s.Val)
- cc.peerMaxHeaderTableSize = s.Val
- case SettingEnableConnectProtocol:
-- if err := s.Valid(); err != nil {
-- return err
-- }
- // If the peer wants to send us SETTINGS_ENABLE_CONNECT_PROTOCOL,
- // we require that it do so in the first SETTINGS frame.
- //
-diff --git a/http2/transport_test.go b/http2/transport_test.go
-index d948b881a3..9068375177 100644
---- a/http2/transport_test.go
-+++ b/http2/transport_test.go
-@@ -5677,6 +5677,19 @@ func testTransportTLSNextProtoConnImmediateFailureUnused(t testing.TB) {
- }
- }
-
-+func TestTransportDoNotHangOnZeroMaxFrameSize(t *testing.T) {
-+ synctestTest(t, testTransportDoNotHangOnZeroMaxFrameSize)
-+}
-+func testTransportDoNotHangOnZeroMaxFrameSize(t testing.TB) {
-+ tc := newTestClientConn(t)
-+ tc.writeSettings(Setting{ID: SettingMaxFrameSize, Val: 0})
-+ tc.wantFrameType(FrameSettings)
+diff --git a/SPECS/etcd/CVE-2026-33814.patch b/SPECS/etcd/CVE-2026-33814.patch
+new file mode 100644
+index 00000000000..330ef2c75ca
+--- /dev/null
++++ b/SPECS/etcd/CVE-2026-33814.patch
+@@ -0,0 +1,42 @@
++From 7e9e82f8c3033974b16d93835521f6e133a7c9aa Mon Sep 17 00:00:00 2001
++From: AllSpark <allspark@microsoft.com>
++Date: Thu, 14 May 2026 09:00:37 +0000
++Subject: [PATCH] http2: prevent hanging Transport due to bad SETTINGS frame
+
-+ req, _ := http.NewRequest("POST", "https://dummy.tld/", strings.NewReader("body"))
-+ tc.roundTrip(req)
-+ // Previously, https://go.dev/issue/78476 caused an infinite hang here.
-+}
++This CL backports https://go.dev/cl/761581 to x/net.
+
- func TestExtendedConnectClientWithServerSupport(t *testing.T) {
- SetDisableExtendedConnectProtocol(t, false)
- ts := newTestServer(t, func(w http.ResponseWriter, r *http.Request) {
++Fixes golang/go#78476
++Fixes CVE-2026-33814
++
++Upstream-reference: https://github.com/golang/net/commit/1e71bd86e4a302b4e731bc06da6eb51679c7bd49.patch
++---
++ vendor/golang.org/x/net/http2/transport.go | 6 +++---
++ 1 file changed, 3 insertions(+), 3 deletions(-)
++
++diff --git a/vendor/golang.org/x/net/http2/transport.go b/vendor/golang.org/x/net/http2/transport.go
++index 8cf64b7..3b514a3 100644
++--- a/vendor/golang.org/x/net/http2/transport.go
+++++ b/vendor/golang.org/x/net/http2/transport.go
++@@ -2865,6 +2865,9 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
++
++ var seenMaxConcurrentStreams bool
++ err := f.ForeachSetting(func(s Setting) error {
+++ if err := s.Valid(); err != nil {
+++ return err
+++ }
++ switch s.ID {
++ case SettingMaxFrameSize:
++ cc.maxFrameSize = s.Val
++@@ -2896,9 +2899,6 @@ func (rl *clientConnReadLoop) processSettingsNoWrite(f *SettingsFrame) error {
++ cc.henc.SetMaxDynamicTableSize(s.Val)
++ cc.peerMaxHeaderTableSize = s.Val
++ case SettingEnableConnectProtocol:
++- if err := s.Valid(); err != nil {
++- return err
++- }
++ // If the peer wants to send us SETTINGS_ENABLE_CONNECT_PROTOCOL,
++ // we require that it do so in the first SETTINGS frame.
++ //
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
Ratiranjan5
force-pushed
the
topic_etcd-3.0
branch
from
2e88be0 to
915cfa0
Compare
4 participants
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
Patch etcd for CVE-2026-33814
etcdis affected by this CVE as it vendorsgolang.org/x/net/http2, and the vendored version in our source isgolang.org/x/net v0.51.0, which falls within the affected range from 0 before0.53.0.Change Log
Does this affect the toolchain?
NO
Links to CVEs
Test Methodology