envoyproxy Envoy Gateway up to 1.7.3/1.8.0 Wasm Image Fetcher imagefetcher.go extractWasmPluginBinary Size resource consumption

Summaryinfo

A vulnerability was found in envoyproxy Envoy Gateway up to 1.7.3/1.8.0. It has been rated as critical. Affected by this vulnerability is the function extractWasmPluginBinary of the file internal/wasm/imagefetcher.go of the component Wasm Image Fetcher. This manipulation of the argument Size causes resource consumption. This vulnerability is handled as CVE-2026-53717. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in envoyproxy Envoy Gateway up to 1.7.3/1.8.0. It has been declared as critical. Affected by this vulnerability is the function extractWasmPluginBinary of the file internal/wasm/imagefetcher.go of the component Wasm Image Fetcher. The manipulation of the argument Size with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm[].code.image.url values to Docker or OCI Wasm layers, and extractWasmPluginBinary uses the untrusted tar-header h.Size value to allocate memory before validating the entry name or declared size. A small PAX or GNU tar header can therefore claim a multi-terabyte entry even though the surrounding LimitReader restricts only the bytes read from the stream, and no registry allowlist prevents a permitted tenant from selecting an attacker-controlled registry that the controller can reach. The allocation is attempted for every tar entry and can cause an unrecoverable Go runtime out-of-memory failure; because the custom resource persists, reconciliation repeatedly crash-loops the shared controller and causes a single-request, non-volumetric, cluster-wide control-plane denial of service. This issue is fixed in versions 1.7.4 and 1.8.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-53717 since 06/10/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 1.7.4 or 1.8.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• envoyproxy

Name

• Envoy Gateway

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.8.0

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion