CVE-2026-53717

Received Received - Intake

Memory Allocation Failure in Envoy Gateway

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-53717

Affected Vendors & Products

Vendor	Product	Version / Range
envoy	gateway	to 1.8.1 (exc)
envoyproxy	gateway	1.7.4
envoyproxy	gateway	1.8.1
envoyproxy	gateway	to 1.7.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Envoy Gateway (versions prior to 1.7.4 and 1.8.1) involves memory allocation based on untrusted tar header sizes during OCI layer extraction. An attacker can craft a maliciously large tar header (e.g., multi-terabyte) using PAX or GNU encoding, causing an unrecoverable out-of-memory (OOM) error in the Go runtime. This triggers a crash-loop in the shared controller, leading to a cluster-wide denial-of-service (DoS) due to the persistent nature of the custom resource triggering the issue.

Detection Guidance

Detecting CVE-2026-53717 requires checking the Envoy Gateway version in use. Run: kubectl get pods -n <namespace> -l app=envoy-gateway -o jsonpath='{.items[0].metadata.labels.version}' or check deployment logs for version details. If the version is below 1.7.4 or 1.8.1, the system is vulnerable.

Impact Analysis

The vulnerability allows a tenant with minimal privileges to disrupt the entire Envoy Gateway control plane with a single malicious request. This results in a non-volumetric, cluster-wide denial-of-service where the controller repeatedly crashes and restarts, making the system unavailable for all users and workloads.

Mitigation Strategies

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1 immediately. Apply the patch from the official repository or use your package manager to update. Ensure no custom EnvoyExtensionPolicy CRDs reference untrusted WASM layers during the upgrade.

Hi! I’m here to help you understand CVE-2026-53717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70