Denial of Service Vulnerability in Envoy Gateway
CVE-2026-53716
What is CVE-2026-53716?
The Envoy Gateway, used for managing Envoy Proxy, is susceptible to a Denial of Service vulnerability. This arises from the getFileFromGZ function in the internal/wasm/httpfetcher.go file, which processes gzip input without a proper limit on the decompressed size. If a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a compressed Wasm payload, a malicious entity could exploit this by submitting a small gzip request causing a significant memory allocation, leading to out-of-memory termination of the shared controller. Consequently, this can trigger controller restarts, disrupt the persistent custom resource, and lead to cross-tenant outages. The issue has been addressed in the updated releases 1.7.4 and 1.8.1.
Affected Version(s)
gateway < 1.7.4 < 1.7.4
gateway >= 1.8.0-rc.0, < 1.8.1 < 1.8.0-rc.0, 1.8.1