What is the CVSS score of CVE-2026-48044?

CVE-2026-48044 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Envoy are affected by CVE-2026-48044?

Envoy proxy versions 1.23.0 through 1.35.10, 1.36.6, 1.37.2, and 1.38.0 contain a remote denial-of-service vulnerability that can crash proxy instances when zstd decompression is enabled.. A patch is available.

How to fix or mitigate CVE-2026-48044?

Within 24 hours: Identify all Envoy deployments running affected versions; audit which instances have zstd decompression enabled and classify by business criticality. Within 7 days: Disable zstd decompression where operationally feasible; for systems requiring zstd, implement network-level access controls restricting inbound traffic to Envoy endpoints, and deploy monitoring for abnormal memory usage and proxy crashes. Within 30 days: Establish continuous monitoring of Envoy security advisories for patch availability; develop and test upgrade pathways to non-vulnerable versions; architect failover or load-balancing strategies for critical Envoy instances that cannot be rapidly patched.

Envoy CVE-2026-48044

EUVD-2026-39820 HIGH

Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)

2026-06-26 GitHub_M

Denial Of Service Envoy

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity payload causes proxy OOM with availability-only impact; no confidentiality or integrity loss, and scope remains unchanged within the process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:32 vuln.today

DescriptionCVE.org

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

AnalysisAI

Denial of service in Envoy proxy (versions 1.23.0 through 1.35.10, 1.36.6, 1.37.2, and 1.38.0) allows remote unauthenticated attackers to crash the proxy by sending a specially crafted, highly compressed zstd payload that triggers massive memory allocation in the ZstdDecompressorImpl, leading to Out-Of-Memory kills. The flaw is a decompression-bomb (data amplification) issue that only manifests when zstd decompression is enabled. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Envoy with zstd decompression enabled

Delivery

Send crafted highly compressed zstd payload

Exploit

Decompressor allocates massive memory

Execution

Process hits Out-Of-Memory kill

Impact

Proxy and fronted traffic denied

Access

Reach Envoy with zstd decompression enabled

Delivery

Send crafted highly compressed zstd payload

Exploit

Decompressor allocates massive memory

Execution

Process hits Out-Of-Memory kill

Impact

Proxy and fronted traffic denied

Vulnerability AssessmentAI

Exploitation	Exploitation requires that Envoy's zstd decompressor (ZstdDecompressorImpl / decompressor filter configured for zstd) is explicitly enabled - this is a non-default configuration, which is the key limiting factor. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with a network-reachable, low-complexity, unauthenticated availability-only DoS - there is no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a single small HTTP request (or response, for an attacker-controlled upstream) with a Content-Encoding of zstd carrying a crafted highly compressed payload to an Envoy instance that has the zstd decompressor enabled. Envoy attempts to inflate the payload, allocating gigabytes of memory and triggering an Out-Of-Memory kill that drops the proxy and all traffic it fronts. …
Remediation	Vendor-released patch: upgrade to Envoy 1.35.11, 1.36.7, 1.37.3, or 1.38.1 (whichever matches your release line); for the 1.23.x-1.34.x range, move to a supported fixed line as those branches are not separately patched. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all Envoy deployments running affected versions; audit which instances have zstd decompression enabled and classify by business criticality. …

Threat intelligence, references, and detailed analysis are available after sign-in.