Bug 2455544 (CVE-2026-33817)

Summary: CVE-2026-33817 go.etcd.io/bbolt: go.etcd.io/bbolt: Denial of Service via index out-of-range error
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: aazores, abuckta, akoudelk, alcohan, amctagga, anjoseph, aoconnor, aprice, bdettelb, bniver, caswilli, cmah, crizzo, dfreiber, dhanak, dkeler, dkuc, doconnor, drosa, drow, dschmidt, dsimansk, eaguilar, ebaron, eborisov, eglynn, erezende, eshamard, fdeutsch, flucifre, gmeno, gparvin, groman, gtanzill, jbalunas, jburrell, jbuscemi, jcantril, jdobes, jjoyce, jkoehler, jlanda, jmitchel, jolong, jprabhak, jpretori, jsamir, jschluet, jsherril, jvasik, kaycoth, kgaikwad, kingland, kshier, kverlaen, lball, lbragsta, lgamliel, lhh, lphiri, mbenjamin, mburns, mgarciac, mhackett, mnovotny, mstipich, mwringe, ngough, oezr, orabin, oramraz, pahickey, pjindal, rblanco, rexwhite, rfreiman, rhaigner, rhel-process-autobot, rjohnson, rochandr, rojacob, sausingh, sbratsla, sdawley, simaishi, smcdonal, smullick, sostapov, stcannon, sthirugn, stirabos, suppawar, teagle, thason, vereddy, veshanka, vkumar, watson-tool-maintainers, wenshen, wtam, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2456001, 2456003, 2456008, 2456009, 2456010, 2456011, 2456016, 2456019, 2456020, 2456021, 2456024, 2456025, 2456026, 2456027, 2456028, 2456029, 2456031, 2456032, 2456033, 2456034, 2456044, 2456045, 2456048, 2455998, 2455999, 2456000, 2456002, 2456004, 2456005, 2456006, 2456007, 2456012, 2456013, 2456014, 2456015, 2456017, 2456018, 2456022, 2456023, 2456030, 2456035, 2456036, 2456037, 2456038, 2456039, 2456040, 2456041, 2456042, 2456043, 2456046, 2456047, 2456049    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-06 19:01:31 UTC
Index out-of-range when encountering a branch page with zero elements in go.etcd.io/bbolt

Comment 4 Carl George 🤠 2026-06-11 23:05:06 UTC
> CVE confirmed to be a false positive

https://nvd.nist.gov/vuln/detail/CVE-2026-33817