EUVD-2026-78069Published
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-53717 · Microsoft / collected KEV context
cve-program · CVE-2026-53717
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
euvd · EUVD-2026-78069
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
nvd · CVE-2026-53717
- https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464
- https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7
- https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead
- https://github.com/envoyproxy/gateway/pull/9171
- https://github.com/envoyproxy/gateway/pull/9172
- https://github.com/envoyproxy/gateway/pull/9173
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x
osv · GHSA-h7pq-86h8-rp5x
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x
- https://github.com/envoyproxy/gateway
osv · GO-2026-6008
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.