CVE-2026-53717

Name of the Vulnerable Software and Affected Versions Envoy Gateway (affected versions not specified)

Description An issue exists during OCI layer extraction where the system allocates memory using make([]byte, h.Size) based on the size declared in a tar header. Because the LimitReader only bounds the bytes read from the stream and not the size declared in the header, an attacker can use PAX/GNU encoding to claim a multi-terabyte entry. This is reachable via the spec.wasm[].code.image.url parameter in the EnvoyExtensionPolicy resource. The resulting Out-of-Memory (OOM) error is unrecoverable and causes the shared controller to enter a crash-loop, leading to a cluster-wide Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.