CVE-2026-47774Envoy is an open source edge and service proxy designed for cloud-native applications.
Updated under an hour ago ()
Does this affect you?
It affects envoyproxy envoy and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-405, CWE-770, CWE-409
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jul 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
envoyproxy envoy envoyproxy:envoy | before 1.35.11; from 1.36.0 before 1.36.7; from 1.37.0 before 1.37.3; 1.38.0 | NVD |
redhat openshift_service_mesh redhat:openshift_service_mesh | from 2.6 before 2.6.17; from 3.0 before 3.0.12; from 3.1 before 3.1.9; from 3.2 before 3.2.6; from 3.3 before 3.3.4 | NVD |
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8mitigation, vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/06/04/15mailing-list, mitigation, third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:26210third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:26222third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:26231third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:26247third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:27114third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-47774third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2487465exploit, issue-tracking, third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47774.jsonthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.