CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
Attackers can cause persistent control-plane outages in Envoy Gateway by supplying malicious compressed Wasm payloads that trigger unbounded memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53716?
CVE-2026-53716 is a medium-severity denial of service vulnerability in envoyproxy gateway, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1.
Weakness: CWE-789
Which versions are affected by CVE-2026-53716?
6 open source packages ship an affected version, including github.com/envoyproxy/gateway and envoy-gateway.
| Package | Affected | Fixed in |
|---|---|---|
github.com/envoyproxy/gateway Go | All versions | 1.7.4, 1.8.1 |
github.com/envoyproxy/gateway Go | All versions | 1.7.4 |
github.com/envoyproxy/gateway Go | All versions | 1.7.4 |
github.com/envoyproxy/gateway Go | From 1.8.0-rc.0 | 1.8.1 |
github.com/envoyproxy/gateway Go | From 1.8.0-rc.0 | 1.8.1 |
envoy-gateway Bitnami | All versions | 1.7.4, 1.8.1 |
How do I fix CVE-2026-53716?
Upgrade github.com/envoyproxy/gateway to a fixed version for your release line: 1.7.4 or 1.8.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53716 being exploited?
There is no known exploitation of CVE-2026-53716 in the wild and no public exploit code.
Sources
Also known as BIT-envoy-gateway-2026-53716, CLEANSTART-2026-FY77467, CLEANSTART-2026-JF19024, GHSA-cxpq-8v7q-cg56, GO-2026-6006, MINI-7hhq-5rpw-g7fv and 3 more.