Skip to content
fr Sign in
7.5 High

CVE-2026-48044 Envoy is an open source edge and service proxy designed for cloud-native applications

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Affected products and versions

Product Affected versions Fixed in
envoy 1.38 1.38.0 → < 1.38.1 1.38.1
envoy 1.37 1.37.0 → < 1.37.3 1.37.3
envoy 1.36 1.36.0 → < 1.36.7 1.36.7
envoy 1.23 1.23.0 → < 1.35.11 1.35.11

References

Timeline

  1. Published
  2. Last modified

Other CVEs of envoy

The 98 CVEs of envoy →
CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 High CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 High
Track this CVE