CVE-2026-53716

Received Received - Intake

Memory Exhaustion in Envoy Gateway via Unbounded Wasm Payload

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-53716

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	gateway	1.7.4
envoy	gateway	1.8.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

Envoy Gateway before versions 1.7.4 and 1.8.1 has a vulnerability where getFileFromGZ in internal/wasm/httpfetcher.go reads gzip-compressed Wasm payloads without limiting decompressed size. A tenant-controlled URL can point to a small compressed file that expands to multi-gigabytes, causing out-of-memory crashes in the controller. This leads to repeated restarts and potential cross-tenant control-plane outages.

Detection Guidance

Detecting this vulnerability requires checking Envoy Gateway versions and monitoring for unusual memory usage or controller restarts. Verify installed versions with 'envoy-gateway version' or check container tags if running in Kubernetes. Monitor controller logs for out-of-memory errors or repeated restarts, which may indicate exploitation attempts.

Impact Analysis

If exploited, this vulnerability can cause the Envoy Gateway controller to crash repeatedly due to memory exhaustion. This disrupts gateway management, leads to downtime for all tenants, and may require manual intervention to restore service. Affected systems depend on Envoy Gateway versions before 1.7.4 or 1.8.1.

Mitigation Strategies

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1 or later immediately. If upgrading is not possible, restrict access to the EnvoyExtensionPolicy.spec.wasm[].code.http.url field by implementing network policies or allowlisting trusted Wasm URLs. Monitor controller resources and logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-53716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70