Denial of Service Vulnerability in Envoy Gateway by Envoy Proxy
CVE-2026-53715
What is CVE-2026-53715?
Envoy Gateway, an open-source framework for managing Envoy Proxy, is susceptible to a Denial of Service (DoS) issue. This arises from a lack of synchronization during concurrent operations within the HTTPServer component, specifically when accessing a shared map for policy translations. An attacker with pod-network access to unauthenticated control ports can exploit this vulnerability by flooding the server with GET requests, leading to a collision between read and write operations. This results in unexpected termination of the server process and disrupts service, causing cross-tenant control-plane failures until the environment is reset. To mitigate this vulnerability, users are advised to upgrade to versions 1.7.4 or 1.8.1, which include the necessary safeguards.
Affected Version(s)
gateway < 1.7.4 < 1.7.4
gateway >= 1.8.0-rc.0, < 1.8.1 < 1.8.0-rc.0, 1.8.1