Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T17:31:37 Envoy: Envoy: Denial of Service via specially crafted zstd payload 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted, highly compressed zstd payload to an Envoy proxy with zstd decompression enabled. This can lead to massive memory allocation, causing severe memory exhaustion and potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy.

This vulnerability in Envoy's zstd decompressor is rated as Important, as a remote, unauthenticated attacker can induce a denial of service. By sending a specially crafted zstd payload, an attacker can cause excessive memory allocation, leading to an Out-Of-Memory condition and service disruption for Envoy proxy instances deployed in Red Hat environments. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat OpenShift Service Mesh 3.0 2026-08-03T00:00:00Z RHSA-2026:49705 openshift-service-mesh/istio-proxyv2-rhel9:1784908682 Red Hat OpenShift Service Mesh 3.1 2026-08-03T00:00:00Z RHSA-2026:49729 openshift-service-mesh/istio-proxyv2-rhel9:1784953556 Red Hat OpenShift Service Mesh 3.2 2026-08-03T00:00:00Z RHSA-2026:49744 openshift-service-mesh/istio-proxyv2-rhel9:1784953743 Red Hat OpenShift Service Mesh 3.3 2026-08-03T00:00:00Z RHSA-2026:49765 openshift-service-mesh/istio-proxyv2-rhel9:1784908639 OpenShift Service Mesh 2 Will not fix openshift-service-mesh/proxyv2-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-48044 https://nvd.nist.gov/vuln/detail/CVE-2026-48044 https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg