CVE-2026-53715: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in envoyproxy gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.
AI Analysis
Technical Summary
Envoy Gateway versions before 1.7.4 and between 1.8.0-rc.0 and before 1.8.1 have a race condition in the HTTPServer.ServeHTTP method where the plain mappingPath2Cache map is read without synchronization while HTTPServer.Get writes to it during EnvoyExtensionPolicy translation. This concurrent unsynchronized access leads to Go's runtime throwing an error due to concurrent map read and write, which the net/http connection recovery cannot handle. An attacker with pod-network access to the unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests to trigger this condition, causing a timing-dependent, cross-tenant control-plane denial of service until the Kubernetes pod restarts. The issue is fixed in versions 1.7.4 and 1.8.1.
Potential Impact
The vulnerability causes a denial of service by terminating the Envoy Gateway controller process when concurrent map access is detected. This results in a cross-tenant control-plane outage until Kubernetes restarts the affected pod. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Envoy Gateway to version 1.7.4 or later, or 1.8.1 or later, where this race condition has been fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in these versions.
CVE-2026-53715: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in envoyproxy gateway
Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.
CVSS v3.1
Score 5.3medium
Affected software
envoyproxy
gateway
pkg:github/envoyproxy/gatewayRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Envoy Gateway versions before 1.7.4 and between 1.8.0-rc.0 and before 1.8.1 have a race condition in the HTTPServer.ServeHTTP method where the plain mappingPath2Cache map is read without synchronization while HTTPServer.Get writes to it during EnvoyExtensionPolicy translation. This concurrent unsynchronized access leads to Go's runtime throwing an error due to concurrent map read and write, which the net/http connection recovery cannot handle. An attacker with pod-network access to the unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests to trigger this condition, causing a timing-dependent, cross-tenant control-plane denial of service until the Kubernetes pod restarts. The issue is fixed in versions 1.7.4 and 1.8.1.
Potential Impact
The vulnerability causes a denial of service by terminating the Envoy Gateway controller process when concurrent map access is detected. This results in a cross-tenant control-plane outage until Kubernetes restarts the affected pod. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Envoy Gateway to version 1.7.4 or later, or 1.8.1 or later, where this race condition has been fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-10T16:43:31.241Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa85d5955bf5e2cf598a21e
Added to database: 09/14/2026, 20:47:21 UTC
Last enriched: 09/14/2026, 21:02:32 UTC
Last updated: 09/15/2026, 05:09:46 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.