CVE-2026-48044

Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion

State: Published
Severity: 7.5 High
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: May 20, 2026

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M

Weaknesses

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

Product	Versions
envoyenvoyproxy	>= 1.38.0, < 1.38.1Affected >= 1.37.0, < 1.37.3Affected >= 1.36.0, < 1.36.7Affected >= 1.23.0, < 1.35.11Affected

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.