Is CVE-2026-53717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53717 being exploited in the wild.

How severe is CVE-2026-53717?

Medium severity, with a CVSS score of 6.5, published 14 September 2026.

Which products and versions are affected?

github.com/envoyproxy/gateway (Go) SEMVER:introduced=0,fixed=1.7.4,introduced=1.8.0-rc.0,fixed=1.8.1, SEMVER:introduced=1.8.0-rc.0,fixed=1.8.1.

Is there a fix for CVE-2026-53717?

Yes. github.com/envoyproxy/gateway (Go): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53717 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53717?

Check whether you run github.com/envoyproxy/gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53717: Envoy Proxy Envoy Gateway DoS via excessive memory allocation in OCI extraction

CVE-2026-53717 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Envoy Gateway is a tool used to manage network traffic and security policies in cloud environments. A vulnerability in how it handles container image layers allows an attacker to crash the management controller by providing a specially crafted image. This results in a persistent denial-of-service, preventing administrators from managing their network traffic until the system is patched.

Technologies: github.com/envoyproxy/gateway (Go). Vendors: Go.

Quick answers

Is CVE-2026-53717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53717 being exploited in the wild.
How severe is CVE-2026-53717?: Medium severity, with a CVSS score of 6.5, published 14 September 2026.
Which products and versions are affected?: github.com/envoyproxy/gateway (Go) SEMVER:introduced=0,fixed=1.7.4,introduced=1.8.0-rc.0,fixed=1.8.1, SEMVER:introduced=1.8.0-rc.0,fixed=1.8.1.
Is there a fix for CVE-2026-53717?: Yes. github.com/envoyproxy/gateway (Go): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53717 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53717?: Check whether you run github.com/envoyproxy/gateway (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/envoyproxy/gateway (Go): upgrade to 1.8.1 or later
```
go get github.com/envoyproxy/gateway@v1.8.1
```

Technical details

A memory allocation vulnerability (CWE-789) exists in Envoy Gateway's image fetching logic within `imagefetcher.go`. The component uses the `h.Size` value from a TAR header to allocate a byte slice without verifying if the size is within reasonable limits. An attacker with permissions to create an `EnvoyExtensionPolicy` can point the controller to a malicious OCI registry containing a TAR layer with a manipulated header (e.g., using PAX/GNU encoding to claim a multi-terabyte size). This triggers an unrecoverable Out-of-Memory (OOM) error in the Go runtime, causing the shared controller to crash-loop. Patches are available in versions 1.8.1 and 1.7.4.

Affected products

Envoy Proxy Gateway >= 1.8.0-rc.0, < 1.8.1; < 1.7.4

Identifiers

CVE-2026-53717
GHSA-h7pq-86h8-rp5x
GO-2026-6008

Timeline

2026-06-05: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.