CVE-2026-53716

Name of the Vulnerable Software and Affected Versions Envoy Gateway (affected versions not specified)

Description An issue exists in the Wasm HTTP fetch mechanism where the getFileFromGZ function calls io.ReadAll on a raw gzip.Reader without an output bound. While the compressed input is capped at 256 MiB, the lack of a decompression limit allows an untrusted tenant to provide a specially crafted gzip file (gzip-bomb) via the EnvoyExtensionPolicy.spec.wasm[].code.http.url parameter. This can lead to excessive memory allocation in the shared controller process, resulting in Out-of-Memory (OOM) kills, crash-loops, and a persistent control-plane outage affecting multiple tenants.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.