Upgrade etcd to 3.5.32 for CVE-2026-59818

[durgajagadeesh]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

• Upgrade etcd to 3.5.32 for CVE-2026-59818[Medium]
• Drop CVE-2026-29181, CVE-2026-39821, and CVE-2026-33814 patches; these fixes are already included upstream via bundled dependency updates (go.opentelemetry.io/otel 1.43.0, golang.org/x/net 0.55.0).

Change Log

• Modified file: ./SPECS/etcd/etcd.spec
• Modified file: ./SPECS/etcd/etcd.signature.json
• Modified file: ./cgmanifest.json
• deleted: ./SPECS/etcd/CVE-2026-29181.patch
• deleted: CVE-2026-33814.patch
• deleted: CVE-2026-39821.patch

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/

Test Methodology

• Build summary:

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[durgajagadeesh]

Drop CVE-2026-29181, CVE-2026-39821, and CVE-2026-33814 patches; these fixes are already included in v3.5.32.

1. CVE-2026-29181: As per this CVE description, This affected range below the v1.41.0. However our telemetry/otel version is 1.43.02)
   Upstream Reference: URL

2. CVE-2026-39821: Our source code golang/x/net is v0.55.0 (# golang.org/x/net v0.55.0), although the affected range is listed as from 0 before 0.55.0.
   Upstream Reference: URL

3. CVE-2026-33814: Vendor module "goland/x/net" is affected from 0 before 0.53.0, However our current version is 0.55.0.
   Upstream Reference: URL

[durgajagadeesh]

etcd 3.5.30 → 3.5.32 — Change Breakdown & Compatibility Analysis (Azure Linux)
This upgrade rolls up two upstream patch releases (3.5.31 + 3.5.32). It is a stable-series patch bump — no storage-format, cluster-protocol, or API-breaking changes.

1. Azure Linux packaging changes (spec)
From git diff in SPECS/etcd:

Version 3.5.30 → 3.5.32, Release 2 → 1.
Removed Patch0/1/2 (CVE-2026-29181/39821/33814) + their %build apply lines — now fixed upstream via dependency bumps.
Removed the now-unused %global _default_patch_fuzz 2.
Deleted the 3 CVE-.patch files (staged D).
etcd.signatures.json updated to the 3.5.32 source + vendor hashes.
Packaging otherwise identical: same subpackages (etcd, etcd-tools), binaries (etcd, etcdctl, etcdutl, etcd-dump-), systemd unit, preset, and config file.

Compatibility assessment

Dimension | Impact -- | -- Cluster protocol / rolling upgrade | ✅ Safe — MinClusterVersion stays 3.0.0; standard in-place 3.5.x rolling upgrade On-disk storage / WAL / snapshot | ✅ No format changes CLI flags / etcd-default-conf.yml | ✅ Backward compatible (only additive --v2-deprecation value) gRPC/HTTP API | ✅ No breaking changes Build (Azure Linux) | ✅ Builds offline; ⚠️ needs Go ≥ 1.25.0 in build env (stale

Watch-outs (intended, not regressions):

CRL now enforced on the gRPC path with --listen-client-http-urls — clients using revoked certs that previously slipped through will now be rejected.
Bearer-prefix stripping — if any client deliberately embedded the literal Bearer as part of the token value, that changes.
Log-string change — scrapers matching "invalid JWT token" should switch to "failed to obtain claims from a JWT token", and the raw token is no longer logged.

Recommendations
Verify the Azure Linux golang build package is ≥ 1.25.0 and consider bumping BuildRequires: golang >= 1.25 for accuracy.
Confirm the 3.5.32-1 changelog reflects the rolled-up security fixes (currently it notes the dropped patches — you may want to add the CRL/GHSA-3wh4-j44w-pg92 item).
No consumer action needed for K8s/other clients; standard rolling restart applies.

[Kanishk-Bansal]

we are performing this upgrade for CVE-2026-59818 which you should mention in PR, title, and changelog

[Kanishk-Bansal]

LGTM, Micro version bump to fix the CVE.
dropped patches are covered in this version.

• Buddy Build
• Tarball uploaded
• Changelog entry
• CG Manifest
• PR has security & CVE-fixed-by-upgrade tag

[Kanishk-Bansal]

Thanks for fixing this

[kgodara912]

Minor version bump to fix CVE. The dropped cves are already included in the upgraded version. Though prep section autosetup can be replaced without tar extracation by swapping SOURCE1 and SOURCE2 but it is fine to keep them separate as well. Tarball generation can be further verified in next release. Buddy build is successful. LGTM.