CVE-2026-53717: Envoy Gateway DOS Vulnerability

CVE-2026-53717 Overview

CVE-2026-53717 is a denial-of-service vulnerability in Envoy Gateway, an open source project that manages Envoy Proxy as a standalone or Kubernetes-based application gateway. The flaw resides in internal/wasm/imagefetcher.go, where the extractWasmPluginBinary function trusts the Size field in tar headers before validating the entry. A tenant with permission to create an EnvoyExtensionPolicy can point spec.wasm[].code.image.url at an attacker-controlled OCI or Docker registry that returns a crafted Wasm image. A single crafted request triggers an unrecoverable Go runtime out-of-memory failure, and because the custom resource persists, the shared controller crash-loops on every reconciliation. The result is a non-volumetric, cluster-wide control-plane outage. The issue is fixed in versions 1.7.4 and 1.8.1.

Critical Impact
A single authenticated tenant request can persistently crash the Envoy Gateway controller, producing a cluster-wide control-plane denial of service that survives restarts until the malicious custom resource is removed.

Affected Products

Envoy Gateway versions prior to 1.7.4 (1.7.x branch)
Envoy Gateway versions prior to 1.8.1 (1.8.x branch)
Kubernetes clusters using EnvoyExtensionPolicy with Wasm plugins

Discovery Timeline

2026-09-14 - CVE-2026-53717 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-53717

Vulnerability Analysis

The vulnerability is a memory allocation flaw driven by untrusted input, classified as [CWE-789] Memory Allocation with Excessive Size Value. Envoy Gateway fetches Wasm extension binaries by following the tenant-controlled spec.wasm[].code.image.url value in an EnvoyExtensionPolicy. No registry allowlist restricts the destinations the controller may contact, so any tenant permitted to create the policy can select an attacker-operated registry.

Once the controller pulls the OCI or Docker layer, extractWasmPluginBinary iterates over tar entries and allocates a buffer based on the header h.Size field before validating the entry name or the declared size. A crafted PAX or GNU tar header can declare a multi-terabyte entry while the surrounding LimitReader only bounds bytes actually read from the network stream. The oversize allocation trips the Go runtime out-of-memory killer, terminating the controller process.

Because the malicious EnvoyExtensionPolicy remains in etcd, Kubernetes restarts the controller and reconciliation immediately fetches the same image, producing a persistent crash loop across the entire cluster's data plane management.

Root Cause

The root cause is trusting an attacker-supplied tar header size value for a make([]byte, h.Size) style allocation prior to any sanity check. Combined with the absence of a registry allowlist and the persistent nature of the custom resource, a single small request produces a durable, cluster-wide failure.

Attack Vector

Exploitation requires network access to the Kubernetes API and permission to create an EnvoyExtensionPolicy. The attacker hosts a malicious OCI image whose Wasm layer contains a tar header declaring an oversized entry, then submits a policy that references the image URL. No user interaction is required, and no high-volume traffic is needed.

The vulnerability is described in prose because no proof-of-concept has been published. See the GitHub Security Advisory GHSA-h7pq-86h8-rp5x for full technical details.

Detection Methods for CVE-2026-53717

Indicators of Compromise

Envoy Gateway controller pods entering CrashLoopBackOff with Go runtime fatal error: runtime: out of memory messages in logs.
EnvoyExtensionPolicy resources referencing external or unfamiliar OCI registries in spec.wasm[].code.image.url.
Outbound controller connections to registries not on an approved list, especially immediately preceding controller termination.
Sudden loss of Gateway API reconciliation across the cluster following creation or modification of an EnvoyExtensionPolicy.

Detection Strategies

Audit Kubernetes API server logs for create and update events on EnvoyExtensionPolicy objects and correlate with subsequent controller restarts.
Alert when the Envoy Gateway controller container exits with OOMKilled status or restarts more than a defined threshold within a short window.
Inspect all EnvoyExtensionPolicy manifests and flag image.url values pointing outside a curated set of internal registries.

Monitoring Recommendations

Track controller memory consumption and restart counts with Prometheus alerts tied to the envoy-gateway deployment.
Enable Kubernetes audit logging at the RequestResponse level for the gateway.envoyproxy.io API group.
Forward controller logs and admission events to a central log store for retrospective review of policy changes.

How to Mitigate CVE-2026-53717

Immediate Actions Required

Upgrade Envoy Gateway to version 1.7.4 or 1.8.1, which validate tar entry size and name before allocation.
Restrict the EnvoyExtensionPolicy custom resource with Kubernetes RBAC so only trusted operators can create or modify it.
Enforce an admission policy (OPA Gatekeeper, Kyverno, or ValidatingAdmissionPolicy) that limits spec.wasm[].code.image.url to an approved registry allowlist.
Identify and delete any existing malicious EnvoyExtensionPolicy resources to break the reconciliation crash loop before upgrade.

Patch Information

The project shipped fixes in Envoy Gateway v1.7.4 and Envoy Gateway v1.8.1. Related maintainer changes are tracked in Pull Request #9171, Pull Request #9172, and Pull Request #9173.

The following patch excerpt from commit 5a78db8 shows related hardening bundled into the 1.8 release:

			return emptyDS, nil, err
		}
	}
} else {
	// Custom backend resources still require ReferenceGrant for cross-namespace references.
	if err = t.validateBackendNamespace(backendRef, route, resources, routeType); err != nil {
		return emptyDS, nil, err
	}
}

// Skip processing backends with 0 weight

Source: envoyproxy/gateway commit 5a78db8

Workarounds

Remove or tightly scope EnvoyExtensionPolicy write permissions until the upgrade completes.
Block egress from the Envoy Gateway controller namespace to any registry not explicitly required.
Use admission control to reject policies whose Wasm image URL host is not on an approved list.

bash

# Example: restrict EnvoyExtensionPolicy write access via RBAC
kubectl create clusterrole envoy-ext-policy-writer \
  --verb=create,update,patch,delete \
  --resource=envoyextensionpolicies.gateway.envoyproxy.io

# Bind only to a trusted platform group
kubectl create clusterrolebinding envoy-ext-policy-writers \
  --clusterrole=envoy-ext-policy-writer \
  --group=platform-admins