Executive brief
Envoy is a widely used open-source proxy that manages network traffic for cloud applications. A vulnerability in how it handles certain web requests allows an attacker to force the system to consume massive amounts of memory very quickly. This can cause the service to crash, leading to a total outage for the applications it protects.
Technical details
A vulnerability exists in Envoy's HTTP/2 downstream request processing due to a combination of two flaws: incomplete accounting of cookie header bytes during request header size validation and the enforcement of HPACK header block limits on encoded bytes rather than decoded size in the oghttp2/quiche component. An unauthenticated remote attacker can exploit this by sending specially crafted cookie headers using HPACK dynamic table references to cause large memory allocations while bypassing 'max_request_headers_kb' protections. This can be further amplified by HTTP/2 flow-control stalling to delay memory reclamation, leading to Out-Of-Memory (OOM) termination. Patches are available in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected products
- Envoy Proxy Envoy < 1.35.11, >= 1.36.0 < 1.36.7, >= 1.37.0 < 1.37.3, >= 1.38.0 < 1.38.1
Timeline
- 2026-06-03: advisory: GitHub advisory GHSA-22m2-hvr2-xqc8 published
- 2026-06-17: disclosed: CVE-2026-47774 published to NVD