CVE-2026-53716
Fixed in a distro release EPSS <1%CVSS 6.5
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.
Products: envoyproxy gateway
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/envoyproxy/gateway | 1.8.1 |
| Go | github.com/envoyproxy/gateway | 1.7.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | datadog-agent-7.76 | no fix |
| Chainguard | datadog-cluster-agent-7.73 | 7.73.3-r23 |
| Chainguard | datadog-cluster-agent-7.74 | 7.74.1-r24 |
| Chainguard | datadog-cluster-agent-7.75 | no fix |
| Chainguard | datadog-cluster-agent-7.76 | 7.76.3-r32 |
| Chainguard | datadog-cluster-agent-7.77 | 7.77.3-r23 |
| Chainguard | datadog-cluster-agent-7.78 | 7.78.4-r16 |
| Chainguard | datadog-cluster-agent-7.79 | 7.79.2-r15 |
| Chainguard | datadog-cluster-agent-7.80 | 7.80.4-r7 |
| Chainguard | datadog-cluster-agent-fips-7.73 | 7.73.3-r26 |
| Chainguard | datadog-cluster-agent-fips-7.74 | 7.74.1-r26 |
| Chainguard | datadog-cluster-agent-fips-7.75 | no fix |
| Chainguard | datadog-cluster-agent-fips-7.76 | 7.76.3-r32 |
| Chainguard | datadog-cluster-agent-fips-7.77 | 7.77.3-r29 |
| Chainguard | datadog-cluster-agent-fips-7.78 | 7.78.4-r14 |
| Chainguard | datadog-cluster-agent-fips-7.79 | 7.79.2-r8 |
| Chainguard | datadog-cluster-agent-fips-7.80 | 7.80.4-r5 |
| Chainguard | envoy-gateway-1.5 | no fix |
| Chainguard | envoy-gateway-1.5-egctl | no fix |
| Chainguard | envoy-gateway-1.6 | no fix |
| Chainguard | envoy-gateway-1.6-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.5 | no fix |
| Chainguard | envoy-gateway-fips-1.5-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.6 | no fix |
| Chainguard | envoy-gateway-fips-1.6-egctl | no fix |
| Chainguard | gitlab-operator | 3.1.2-r1 |
| Chainguard | gitlab-operator-fips | 3.2.0-r0 |
| Chainguard | tigera-operator-1.37 | no fix |
| Chainguard | tigera-operator-1.38 | 0 |
| Chainguard | tigera-operator-1.40 | 1.40.13-r4 |
| Chainguard | tigera-operator-1.41 | 0 |
| Chainguard | tigera-operator-1.42 | 1.42.4-r2 |
| Chainguard | tigera-operator-fips-1.37 | no fix |
| Chainguard | tigera-operator-fips-1.38 | 0 |
| Chainguard | tigera-operator-fips-1.40 | 1.40.13-r5 |
| Chainguard | tigera-operator-fips-1.41 | 0 |
| Chainguard | tigera-operator-fips-1.42 | 1.42.4-r4 |
| Wolfi | datadog-agent-7.76 | no fix |
| Wolfi | datadog-cluster-agent-7.73 | 7.73.3-r23 |
| Wolfi | datadog-cluster-agent-7.75 | no fix |
| Wolfi | datadog-cluster-agent-7.76 | 7.76.3-r32 |
| Wolfi | datadog-cluster-agent-7.77 | 7.77.3-r23 |
| Wolfi | datadog-cluster-agent-7.78 | 7.78.4-r16 |
| Wolfi | datadog-cluster-agent-7.79 | 7.79.2-r15 |
| Wolfi | datadog-cluster-agent-7.80 | 7.80.4-r7 |
| Wolfi | tigera-operator-1.40 | 1.40.13-r4 |
| Wolfi | tigera-operator-1.41 | 0 |
| Wolfi | tigera-operator-1.42 | 1.42.4-r2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |