CVE-2026-53715

Name of the Vulnerable Software and Affected Versions Envoy Gateway (affected versions not specified)

Description Concurrent access to the mappingPath2Cache map in httpserver.go can lead to a control-plane Denial of Service. The ServeHTTP function reads from the map without a lock, while other processes write to it under s.Lock(). Because Go's runtime detects concurrent map read and write operations and triggers a fatal error that cannot be recovered by the net/http server, the controller process crashes. This can be triggered by an attacker flooding GET requests while simultaneously modifying EnvoyExtensionPolicy with distinct Wasm URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.