Executive brief
Envoy is a widely used service proxy that manages network traffic for cloud applications. A vulnerability in its Zstd decompression component allows an attacker to send a specially crafted, highly compressed data packet that causes the proxy to consume massive amounts of memory. This can lead to the proxy crashing or being shut down by the operating system, resulting in a total service outage for all applications relying on that Envoy instance.
Technical details
A resource exhaustion vulnerability (CWE-409/CWE-400) exists in Envoy's ZstdDecompressorImpl due to improper placement of inflation ratio checks. While Envoy defines a MaxInflateRatio to prevent decompression bombs, the check is performed in the outer loop after a full data slice has been processed, rather than within the inner processing loop. An attacker can send a small, highly compressed Zstd payload that expands to hundreds of megabytes during a single 'process()' call, bypassing the limit check until the memory has already been allocated. This leads to an Out-Of-Memory (OOM) termination of the Envoy process. The vulnerability is reachable over the network without authentication if Zstd decompression is enabled. Patches are available in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected products
- Envoy Proxy Envoy >= 1.23.0, < 1.35.11; >= 1.36.0, < 1.36.7; >= 1.37.0, < 1.37.3; >= 1.38.0, < 1.38.1
Timeline
- 2026-06-23: advisory: GitHub Security Advisory published by maintainers
- 2026-06-26: disclosed: CVE published to NVD