CVE-2026-33817 - Vulnerability Details - OpenCVE

Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Etcd-io	Bbolt

No data.

No data.

References

Link	Providers
https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143
https://github.com/golang/vulndb/issues/4923
https://pkg.go.dev/vuln/GO-2026-4923

History

Tue, 07 Apr 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Etcd-io Etcd-io bbolt
Vendors & Products		Etcd-io Etcd-io bbolt

Tue, 07 Apr 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 06 Apr 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt
Title		Vulnerability in go.etcd.io/bbolt
References		https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143 https://github.com/golang/vulndb/issues/4923 https://pkg.go.dev/vuln/GO-2026-4923

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-04-06T18:13:23.996Z

Updated: 2026-04-06T19:25:23.842Z

Reserved: 2026-03-23T20:35:32.815Z

Link: CVE-2026-33817

Vulnrichment

Updated: 2026-04-06T19:23:47.201Z

NVD

Status : Awaiting Analysis

Published: 2026-04-06T19:16:27.677

Modified: 2026-04-07T13:20:11.643

Link: CVE-2026-33817

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33817", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-03-23T20:35:32.815Z", "datePublished": "2026-04-06T18:13:23.996Z", "dateUpdated": "2026-04-06T19:25:23.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-04-06T18:13:23.996Z"}, "title": "Vulnerability in go.etcd.io/bbolt", "descriptions": [{"lang": "en", "value": "Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt"}], "affected": [{"vendor": "go.etcd.io/bbolt", "product": "go.etcd.io/bbolt", "collectionURL": "https://pkg.go.dev", "packageName": "go.etcd.io/bbolt", "programRoutines": [{"name": "Bucket.Stats"}, {"name": "Bucket.CreateBucket"}, {"name": "Bucket.CreateBucketIfNotExists"}, {"name": "Bucket.Delete"}, {"name": "Bucket.DeleteBucket"}, {"name": "Bucket.ForEach"}, {"name": "Bucket.ForEachBucket"}, {"name": "Bucket.MoveBucket"}, {"name": "Bucket.NextSequence"}, {"name": "Bucket.Put"}, {"name": "Bucket.SetSequence"}, {"name": "Compact"}, {"name": "Cursor.Delete"}, {"name": "DB.Batch"}, {"name": "DB.Begin"}, {"name": "DB.Close"}, {"name": "DB.Sync"}, {"name": "DB.Update"}, {"name": "DB.View"}, {"name": "DefaultLogger.Debug"}, {"name": "DefaultLogger.Debugf"}, {"name": "DefaultLogger.Error"}, {"name": "DefaultLogger.Errorf"}, {"name": "DefaultLogger.Fatal"}, {"name": "DefaultLogger.Fatalf"}, {"name": "DefaultLogger.Info"}, {"name": "DefaultLogger.Infof"}, {"name": "DefaultLogger.Panic"}, {"name": "DefaultLogger.Panicf"}, {"name": "DefaultLogger.Warning"}, {"name": "DefaultLogger.Warningf"}, {"name": "Open"}, {"name": "Tx.Check"}, {"name": "Tx.Commit"}, {"name": "Tx.Copy"}, {"name": "Tx.CopyFile"}, {"name": "Tx.CreateBucket"}, {"name": "Tx.CreateBucketIfNotExists"}, {"name": "Tx.DeleteBucket"}, {"name": "Tx.ForEach"}, {"name": "Tx.MoveBucket"}, {"name": "Tx.Rollback"}, {"name": "Tx.WriteTo"}], "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "references": [{"url": "https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143"}, {"url": "https://github.com/golang/vulndb/issues/4923"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4923"}], "credits": [{"lang": "en", "value": "Quoc Bui (github.com/quocvibui)"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T19:24:37.514979Z", "id": "CVE-2026-33817", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T19:25:23.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-33817", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T19:24:37.514979Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T19:23:47.201Z"}}], "cna": {"title": "Vulnerability in go.etcd.io/bbolt", "credits": [{"lang": "en", "value": "Quoc Bui (github.com/quocvibui)"}], "affected": [{"vendor": "go.etcd.io/bbolt", "product": "go.etcd.io/bbolt", "packageName": "go.etcd.io/bbolt", "collectionURL": "https://pkg.go.dev", "defaultStatus": "affected", "programRoutines": [{"name": "Bucket.Stats"}, {"name": "Bucket.CreateBucket"}, {"name": "Bucket.CreateBucketIfNotExists"}, {"name": "Bucket.Delete"}, {"name": "Bucket.DeleteBucket"}, {"name": "Bucket.ForEach"}, {"name": "Bucket.ForEachBucket"}, {"name": "Bucket.MoveBucket"}, {"name": "Bucket.NextSequence"}, {"name": "Bucket.Put"}, {"name": "Bucket.SetSequence"}, {"name": "Compact"}, {"name": "Cursor.Delete"}, {"name": "DB.Batch"}, {"name": "DB.Begin"}, {"name": "DB.Close"}, {"name": "DB.Sync"}, {"name": "DB.Update"}, {"name": "DB.View"}, {"name": "DefaultLogger.Debug"}, {"name": "DefaultLogger.Debugf"}, {"name": "DefaultLogger.Error"}, {"name": "DefaultLogger.Errorf"}, {"name": "DefaultLogger.Fatal"}, {"name": "DefaultLogger.Fatalf"}, {"name": "DefaultLogger.Info"}, {"name": "DefaultLogger.Infof"}, {"name": "DefaultLogger.Panic"}, {"name": "DefaultLogger.Panicf"}, {"name": "DefaultLogger.Warning"}, {"name": "DefaultLogger.Warningf"}, {"name": "Open"}, {"name": "Tx.Check"}, {"name": "Tx.Commit"}, {"name": "Tx.Copy"}, {"name": "Tx.CopyFile"}, {"name": "Tx.CreateBucket"}, {"name": "Tx.CreateBucketIfNotExists"}, {"name": "Tx.DeleteBucket"}, {"name": "Tx.ForEach"}, {"name": "Tx.MoveBucket"}, {"name": "Tx.Rollback"}, {"name": "Tx.WriteTo"}]}], "references": [{"url": "https://github.com/etcd-io/bbolt/pull/1171/changes/386d5b69785937d1aa20cb25c8439404cf398143"}, {"url": "https://github.com/golang/vulndb/issues/4923"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4923"}], "descriptions": [{"lang": "en", "value": "Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-04-06T18:13:23.996Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33817", "state": "PUBLISHED", "dateUpdated": "2026-04-06T19:25:23.842Z", "dateReserved": "2026-03-23T20:35:32.815Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-04-06T18:13:23.996Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}