CVE-2026-48044

Name of the Vulnerable Software and Affected Versions Envoy versions 1.23.0 through 1.35.10 Envoy versions 1.36.0 through 1.36.6 Envoy versions 1.37.0 through 1.37.2 Envoy versions 1.38.0 through 1.38.0

Description A flaw exists in the zstd decompressor implementation ZstdDecompressorImpl. When zstd decompression is enabled, the proxy may perform massive memory allocation while processing a specially crafted, highly compressed zstd payload. This can lead to severe memory exhaustion, resulting in an Out-Of-Memory (OOM) kill—a condition where the operating system terminates a process to free up memory—and a subsequent Denial of Service (DoS).

Recommendations Update to version 1.35.11. Update to version 1.36.7. Update to version 1.37.3. Update to version 1.38.1. As a temporary mitigation, disable zstd decompression.