CVE-2026-47774 Overview
CVE-2026-47774 is a denial-of-service vulnerability in Envoy, an open source edge and service proxy widely deployed in cloud-native architectures and service meshes. The flaw resides in Envoy's HTTP/2 downstream request processing path. An unauthenticated remote client can trigger excessive memory consumption by exploiting gaps in header size accounting, leading to out-of-memory (OOM) termination of the Envoy process.
The vulnerability affects Envoy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1. It is classified under [CWE-405] (Asymmetric Resource Consumption).
Critical Impact
Remote attackers can crash Envoy proxy instances without authentication, disrupting traffic for all services routed through the affected proxy.
Affected Products
- Envoy versions prior to 1.35.11
- Envoy versions prior to 1.36.7
- Envoy versions prior to 1.37.3 and 1.38.1
Discovery Timeline
- 2026-06-17 - CVE-2026-47774 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47774
Vulnerability Analysis
The vulnerability stems from the interaction between two distinct behaviors in Envoy's HTTP/2 handling. Envoy applies a configurable request header size limit to protect against oversized header attacks. However, this limit is incompletely enforced when cookie headers and HPACK-compressed header blocks are involved.
A malicious client can craft HTTP/2 requests that pass encoded-byte size checks while expanding into much larger decoded header structures in memory. Sustained or parallel abusive requests can exhaust available memory and cause OOM termination of the Envoy worker process. Because Envoy frequently sits at the ingress edge of clusters and service meshes, a single instance crash can interrupt traffic for many downstream services.
Root Cause
Two issues combine to produce the vulnerability. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, the HPACK header block limits enforced by the oghttp2 and quiche libraries apply only to encoded bytes, with no corresponding cap on total decoded header size. Decoded headers can therefore grow far beyond the configured request header size limit.
Attack Vector
The attack requires only network access to an Envoy listener with HTTP/2 enabled on the downstream side. No authentication or user interaction is needed. An attacker sends HTTP/2 requests containing crafted HPACK-encoded headers, particularly cookie headers, that decode into large in-memory structures. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-22m2-hvr2-xqc8 and the OpenWall OSS-Security discussion.
Detection Methods for CVE-2026-47774
Indicators of Compromise
- Abnormal memory growth on Envoy processes correlated with downstream HTTP/2 traffic.
- Envoy worker OOM kills recorded in container, systemd, or kernel logs.
- Spikes in HTTP/2 requests with unusually large cookie headers or many HPACK header fields from a single source.
- Increased rate of HTTP/2 stream resets or connection terminations under load.
Detection Strategies
- Monitor Envoy server.memory_allocated and server.memory_heap_size statistics for sudden deviation from baseline.
- Alert on Envoy process restarts and oom_kill events in host or container telemetry.
- Inspect HTTP/2 access logs for requests with abnormally large header counts or cookie sizes relative to historical norms.
Monitoring Recommendations
- Ingest Envoy admin and access logs into a centralized analytics platform for correlation across instances.
- Track per-source request rates and header characteristics to identify abusive clients before memory exhaustion occurs.
- Configure alerting thresholds on container memory limits to detect approach to OOM conditions early.
How to Mitigate CVE-2026-47774
Immediate Actions Required
- Upgrade Envoy to version 1.35.11, 1.36.7, 1.37.3, or 1.38.1 or later, matching your current release branch.
- Inventory all Envoy deployments, including those embedded in service mesh control planes such as Istio, Consul, and Gloo.
- Review downstream HTTP/2 exposure and identify internet-facing Envoy instances for prioritized patching.
Patch Information
The Envoy maintainers released fixes in versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1. The advisory states that no complete workaround exists short of applying the fix. Patch details are available in the Envoy GitHub Security Advisory.
Workarounds
- Disable downstream HTTP/2 on Envoy listeners where operationally feasible and serve clients over HTTP/1.1.
- Enforce stricter request header and cookie size limits at an upstream layer such as a CDN or load balancer before traffic reaches Envoy.
- Monitor Envoy memory usage continuously and configure container memory limits with restart policies to contain impact.
- Apply rate limiting per source IP on HTTP/2 traffic to reduce the volume of header-heavy requests an attacker can send.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
