CVE-2026-53717: CWE-789: Memory Allocation with Excessive Size Value in envoyproxy gateway
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1.
AI Analysis
Technical Summary
Envoy Gateway versions before 1.7.4 and between 1.8.0-rc.0 and before 1.8.1 contain a memory allocation vulnerability (CWE-789) in the internal/wasm/imagefetcher.go component. The code follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers and uses the untrusted tar header's h.Size value to allocate memory before validating the entry name or declared size. A crafted tar header can claim a multi-terabyte size, causing the Go runtime to attempt large memory allocations leading to out-of-memory failures. Because the custom resource persists, the controller repeatedly crash-loops, causing a cluster-wide control-plane denial of service. This vulnerability is addressed in versions 1.7.4 and 1.8.1.
Potential Impact
The vulnerability allows an attacker with tenant permissions to cause the Envoy Gateway controller to repeatedly crash due to out-of-memory errors triggered by excessive memory allocation attempts. This results in a denial of service affecting the entire cluster's control plane. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Envoy Gateway to version 1.7.4 or later, or 1.8.1 or later, where this issue is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
CVE-2026-53717: CWE-789: Memory Allocation with Excessive Size Value in envoyproxy gateway
Description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1.
CVSS v3.1
Score 6.5medium
Affected software
envoyproxy
gateway
pkg:github/envoyproxy/gatewayRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Envoy Gateway versions before 1.7.4 and between 1.8.0-rc.0 and before 1.8.1 contain a memory allocation vulnerability (CWE-789) in the internal/wasm/imagefetcher.go component. The code follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers and uses the untrusted tar header's h.Size value to allocate memory before validating the entry name or declared size. A crafted tar header can claim a multi-terabyte size, causing the Go runtime to attempt large memory allocations leading to out-of-memory failures. Because the custom resource persists, the controller repeatedly crash-loops, causing a cluster-wide control-plane denial of service. This vulnerability is addressed in versions 1.7.4 and 1.8.1.
Potential Impact
The vulnerability allows an attacker with tenant permissions to cause the Envoy Gateway controller to repeatedly crash due to out-of-memory errors triggered by excessive memory allocation attempts. This results in a denial of service affecting the entire cluster's control plane. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade Envoy Gateway to version 1.7.4 or later, or 1.8.1 or later, where this issue is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-10T16:43:31.241Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8567155bf5e2cf58d7eff
Added to database: 09/14/2026, 20:17:53 UTC
Last enriched: 09/14/2026, 20:32:25 UTC
Last updated: 09/15/2026, 01:27:14 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.