CVE-2026-53716: Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and

Executive brief

Envoy Gateway is a tool used to manage and secure network traffic for applications. A vulnerability exists where the system fails to limit memory usage when downloading and decompressing certain extension files. An attacker with basic tenant permissions can exploit this to crash the management system, causing a persistent service outage for all users.

Technical details

A memory allocation vulnerability (CWE-789) exists in Envoy Gateway's Wasm HTTP fetcher. The 'getFileFromGZ' function in 'httpfetcher.go' utilizes 'io.ReadAll' on a 'gzip.Reader' without an output size limit, even though the compressed input is capped at 256 MiB. An attacker with permissions to create an 'EnvoyExtensionPolicy' can provide a malicious URL pointing to a 'gzip bomb' (e.g., a small compressed file that expands to gigabytes). This results in excessive memory allocation in the shared controller process, leading to OOM-kills and persistent crash-loops during reconciliation. Patches are available in versions 1.7.4 and 1.8.1.

Affected products

• envoyproxy gateway >= 1.8.0-rc.0, < 1.8.1; < 1.7.4

Timeline

• 2026-06-05: disclosed
• 2026-07-16: advisory

References

• https://api.github.com/users/zhaohuabing
• https://github.com/zhaohuabing
• https://api.github.com/users/zhaohuabing/gists%7B/gist_id%7D
• https://api.github.com/users/zhaohuabing/repos
• https://avatars.githubusercontent.com/u/1321762?v=4
• https://api.github.com/users/zhaohuabing/events%7B/privacy%7D