EUVD-2026-78079
GHSA-cxpq-8v7q-cg56
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
S:C corrects the provided vector's S:U because the shared controller crash disrupts all co-tenants; PR:L reflects RBAC-gated EnvoyExtensionPolicy creation access.
Primary rating from Vendor (https://github.com/envoyproxy/gateway).
CVSS VectorVendor: https://github.com/envoyproxy/gateway
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability report without repro case. Repro case may be added later after harness is complete.
Preconditions (4):
- Tenant can create EnvoyExtensionPolicy (baseline)
- Attacker hosts a gzip-bomb at a reachable URL
- sha256 unset (optional field; check is post-decompression anyway)
- No operator Wasm-URL allowlist (none exists in code)
Description
getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops - persistent cross-tenant control-plane outage with PR:L/AC:L and scope change → HIGH despite availability-only.
AnalysisAI
Unbounded gzip decompression in Envoy Gateway's Wasm HTTP fetch path allows a low-privileged tenant to exhaust memory in the shared controller process via a crafted gzip-bomb URL, causing persistent cross-tenant control-plane outages. Any tenant with RBAC permission to create EnvoyExtensionPolicy resources can trigger approximately 10 GiB of heap allocation from a 10 MiB compressed payload, OOM-killing the controller; because the controller restarts and immediately re-reconciles the malicious custom resource, the crash-loop is self-sustaining and affects all co-tenants until the offending policy is deleted or the controller is patched. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 1.7.4 and 1.8.1.
Technical ContextAI
Envoy Gateway is a CNCF-backed Kubernetes API gateway controller written in Go (pkg:go/github.com/envoyproxy/gateway). The vulnerability resides in the Wasm extension fetch subsystem: when an EnvoyExtensionPolicy resource specifies a Wasm module via HTTP URL (spec.wasm[].code.http.url), the controller's httpfetcher.go fetches and decompresses the content. The specific flaw is in the getFileFromGZ function (httpfetcher.go:216), which constructs a gzip.Reader from the HTTP response body and then calls io.ReadAll with no output-size limit. While the compressed input stream is bounded at 256 MiB (httpfetcher.go:139), gzip-of-zeros payloads routinely achieve decompression ratios exceeding 1000:1, meaning a 10 MiB compressed file can expand to approximately 10 GiB in memory. The data flow is envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → httpfetcher.go:233 → httpfetcher.go:216. CWE-789 (Uncontrolled Memory Allocation) precisely describes the root cause: no io.LimitReader or equivalent bound wraps the decompressor output. The optional sha256 integrity field provides no protection because it is checked after decompression completes - meaning the allocation damage occurs before any validation gate fires.
RemediationAI
Upgrade Envoy Gateway to version 1.7.4 (for 1.7.x deployments) or 1.8.1 (for 1.8.x deployments), as confirmed by the GitHub Security Advisory GHSA-cxpq-8v7q-cg56 at https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56. If immediate patching is not feasible, the most effective compensating control is to revoke or restrict RBAC permissions for creating and modifying EnvoyExtensionPolicy resources from untrusted tenants; this eliminates the attack surface entirely but also disables HTTP-based Wasm extension management for those tenants. A secondary control is to implement Kubernetes NetworkPolicy or egress firewall rules on the gateway-controller pod to prevent it from reaching arbitrary external HTTP servers, limiting Wasm URL fetches to an operator-approved set of hosts; this constrains the gzip-bomb delivery mechanism but requires careful allowlist curation to avoid breaking legitimate Wasm workflows. Note that no native Wasm-URL allowlist feature exists in the current codebase, so URL-based filtering must be enforced externally.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today