Go Etcd Io Bbolt CVE-2026-33817

go.etcd.io/bbolt is a pure Go key-value store library implementing an embedded B+tree structure for transactional data storage, commonly used in Go applications requiring local persistence. The root cause is a classic buffer over-read (CWE-125: Out-of-bounds Read) occurring during branch page traversal when the cursor attempts to access array indices without validating that the branch page contains at least one element. The vulnerability manifests in the pagination logic where a branch page with zero child pointers is accessed as if it contained valid entries, leading to memory access beyond allocated bounds and triggering a panic in the Go runtime.