Merge PR "[AUTO-CHERRYPICK] [High] Upgrade etcd to 3.5.28 for CVE-2026-33413 and CVE-2026-33343 - branch 3.0-dev" #16334

Co-authored-by: AkarshHCL <v-akarshc@microsoft.com>

Author: CBL-Mariner-Bot

SPECS/etcd/etcd.signatures.json

@@ -1,7 +1,7 @@
 {
   "Signatures": {
     "etcd.service": "4550a4967ba35670051cbfd9b4edf1fc57c0f1d7a07e51f88351ac44c76d8066",
-    "etcd-3.5.21.tar.gz": "76d7fcafe4fcc957fcd45671226b992c16e5f5e724935dea9df0190ac2b13481",
-    "etcd-3.5.21-vendor.tar.gz": "b4c072080f0ca47c1d447b6547165b943206cb5cb71dbd35a9e68079fdeac5a7"
+    "etcd-3.5.28.tar.gz": "c1e873c174c44de5fb148024d3ad741cae11548b5b6d2ac36a003289e55024be",
+    "etcd-3.5.28-vendor.tar.gz": "7decc96250a76e9807d98834d35657d7f5ccdfd2f3d5e507d8e97bddc05cc79c"
   }
 }

SPECS/etcd/etcd.spec

@@ -2,7 +2,7 @@
 
 Summary:        A highly-available key value store for shared configuration
 Name:           etcd
-Version:        3.5.21
+Version:        3.5.28
 Release:        1%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
@@ -145,6 +145,10 @@ install -vdm755 %{buildroot}%{_sharedstatedir}/etcd
 /%{_docdir}/%{name}-%{version}-tools/*
 
 %changelog
+
+* Fri Mar 27 2026 Akarsh Chaudhary <v-akarshc@microsoft.com> - 3.5.28-1
+- Upgrade to version 3.5.28 (fixes CVE-2026-33413 and CVE-2026-33343).
+
 * Sun Mar 30 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.5.21-1
 - Auto-upgrade to 3.5.21 - for CVE-2025-30204 [High]
 

cgmanifest.json

@@ -3408,8 +3408,8 @@
         "type": "other",
         "other": {
           "name": "etcd",
-          "version": "3.5.21",
-          "downloadUrl": "https://github.com/etcd-io/etcd/archive/v3.5.21.tar.gz"
+          "version": "3.5.28",
+          "downloadUrl": "https://github.com/etcd-io/etcd/archive/v3.5.28.tar.gz"
         }
       }
     },