CVE-2026-53716

The record

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.

Affected packages

Related vulnerabilities

• CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-789
• CVE-2026-77410 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-789
• CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789
• CVE-2026-77354 kin-openapi is a Go project for handling OpenAPI files. CWE-789
• CVE-2026-69219 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-789
• CVE-2026-66485 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at… CWE-789
• CVE-2026-59844 A flaw was found in libssh. CWE-789
• CVE-2026-40378 Memory allocation with excessive size value in Windows Local Security Authority Subsystem… CWE-789