Etcd Patch Releases: v3.7.2, v3.6.15, and v3.5.34
SIG-etcd has distributed patch updates for all three supported release branches. These releases update dependencies, fix a file-handle leak during file cleanup, correct etcdctl endpoint status output, and improve version detection in v3.7. Users on v3.5, v3.6, and v3.7 should update at the next scheduled maintenance window after the releases become available.
Obtain the updates here:
Official container images are available from gcr.io.
Dependency security updates
v3.6.15 and v3.5.34 update github.com/gorilla/websocket to v1.5.3 to address a weak cryptography issue (no CVE is yet allocated).
v3.6.15 also updates golang.org/x/text to v0.39.0 to address CVE-2026-56852.
All three releases compile binaries using Go 1.26.8.
Close locked files after purge failures
All three releases fix a file-handle and advisory-lock leak in purgeFile. If removing a locked file failed, purgeFile previously returned without closing the file. It now closes the locked file before returning the removal error and logs any error encountered while closing it.
Correct etcdctl endpoint status output
All three releases fix a duplicate RaftTerm field in the output of etcdctl endpoint status --write-out=fields. The command now reports the field only once, making its field-formatted output easier for users and automation to consume.
More accurate version detection in v3.7.2
v3.7.2 updates MinimalEtcdVersion to read the latest snapshot entry from the write-ahead log (WAL). This prevents an error where an upgraded etcd cluster might read a v2 snapshot instead of a v3 one.
Full changelogs for each release: