{"id":"EUVD-2026-78079","enisaUuid":"e444780d-5b3d-3c21-ae06-52b70deace6c","description":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.","datePublished":"Sep 14, 2026, 8:15:51 PM","dateUpdated":"Sep 16, 2026, 4:21:20 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56\nhttps://github.com/envoyproxy/gateway/pull/9171\nhttps://github.com/envoyproxy/gateway/pull/9172\nhttps://github.com/envoyproxy/gateway/pull/9173\nhttps://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464\nhttps://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7\nhttps://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.7.4\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.8.1\n","aliases":"CVE-2026-53716\nGHSA-cxpq-8v7q-cg56\n","assigner":"GitHub_M","epss":0.72,"enisaIdProduct":[{"id":"11a45b28-a411-354b-9621-fa433dc03327","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"1.8.0-rc.0, \u003c 1.8.1"},{"id":"dab6b5e3-8ce4-3056-9256-9a443cd31680","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.7.4"}],"enisaIdVendor":[{"id":"045c171c-8b29-363f-8c8b-a66b7d576644","vendor":{"name":"envoyproxy"}}],"enisaIdVulnerability":[{"id":"e99f980f-ed94-39e8-8f38-96d730fa7d81","vulnerability":{"id":"CVE-2026-53716","description":"Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.","datePublished":"Sep 14, 2026, 8:15:51 PM","dateUpdated":"Sep 16, 2026, 4:21:20 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56\nhttps://github.com/envoyproxy/gateway/pull/9171\nhttps://github.com/envoyproxy/gateway/pull/9172\nhttps://github.com/envoyproxy/gateway/pull/9173\nhttps://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464\nhttps://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7\nhttps://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.7.4\nhttps://github.com/envoyproxy/gateway/releases/tag/v1.8.1\n","enisa_id":"EUVD-2026-78079\n","assigner":"GitHub_M","epss":0.72,"dataProcessed":"Nov 5, 2026, 7:16:59 AM","vulnerabilityProduct":[{"id":"13c2230d-8787-3388-a279-6692965a00ce","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"1.8.0-rc.0, \u003c 1.8.1"},{"id":"71d5af77-28ff-3013-84eb-60c41f76e807","product":{"name":"Gateway","vendor":{"name":"NetScaler"}},"product_version":"\u003c 1.7.4"}],"vulnerabilityVendor":[{"id":"18adb941-d4f4-311d-a871-22676572f967","vendor":{"name":"envoyproxy"}}]}},{"id":"fd63a120-1af8-3492-b42b-466e2d4ee0bb","vulnerability":{"id":"GHSA-cxpq-8v7q-cg56","description":"Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit","datePublished":"Jul 16, 2026, 7:18:08 PM","dateUpdated":"Jul 16, 2026, 7:18:08 PM","baseScore":0.0,"references":"https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56\nhttps://github.com/envoyproxy/gateway\n","enisa_id":"EUVD-2026-78079\n","aliases":"GHSA-cxpq-8v7q-cg56\nCVE-2026-53716\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}