medium

CVE-2026-53716

Go · github.com/envoyproxy/gateway

Summary

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Severity
medium
CVSS
6.5
EPSS
0.7% (p53)
CWE
CWE-789
Also known as
GHSA-cxpq-8v7q-cg56
Published
2026-07-16
Updated
2026-07-16

Advisory details

Vulnerability report without repro case. Repro case may be added later after harness is complete.

Preconditions (4):

Description

getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops — persistent cross-tenant control-plane outage with PR:L/AC:L and scope change → HIGH despite availability-only.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.