Envoy Gateway versions before 1.7.4 and between 1.8.0-rc.0 and before 1.8.1 contain a NULL pointer dereference in the function translateSecurityPolicyForRoute within internal/gatewayapi/securitypolicy.go. This happens when a SecurityPolicy targeting a TCPRoute omits the spec.authorization field, leading to a nil authorization value dereference. The resulting panic occurs on every reconcile cycle, causing the controller's xDS and intermediate-representation publishing to stall until the problematic SecurityPolicy object is deleted. The data plane remains operational with the last known good configuration. This vulnerability is resolved in versions 1.7.4 and 1.8.1.

The vulnerability causes a denial of service condition at the control plane level by stalling controller-wide xDS and infrastructure intermediate-representation publishing. While the data plane continues to serve the last known good configuration, no new configuration updates are published until the faulty SecurityPolicy object is removed by an administrator. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 6.5 (medium severity) with an impact rating of high availability impact.

Upgrade to Envoy Gateway version 1.7.4 or later, or 1.8.1 or later, where this issue is fixed. Until the upgrade, administrators can mitigate the impact by deleting any SecurityPolicy objects that omit the spec.authorization field when targeting TCPRoute to prevent the controller from stalling. No other mitigations are indicated by the vendor advisory.