CVE-2026-47774

Vulnerability overview

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced o...

Affected product and versions

Product

envoyproxy envoy, Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Service Mesh 3.0

Affected versions

>= < 1.35.11, >= >= 1.36.0, < 1.36.7, >= >= 1.37.0, < 1.37.3, >= >= 1.38.0, < 1.38.1, < 1.35.11, >= 1.36.0 < 1.36.7, >= 1.37.0 < 1.37.3, 1.38.0, >= 2.6 < 2.6.17, >= 3.0 < 3.0.12, >= 3.1 < 3.1.9, >= 3.2 < 3.2.6, >= 3.3 < 3.3.4

Fixed versions

1.35.11, 1.36.7, 1.37.3, 2.6.17, 3.0.12, 3.1.9, 3.2.6, 3.3.4

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-405, CWE-409, CWE-770