CVE-2026-48044 Details
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
A memory exhaustion vulnerability has been identified in Envoy's Zstd decompressor implementation, affecting versions 1.23.0 prior to 1.39. When Zstd decompression is enabled, processing a specially crafted, highly compressed Zstd payload can cause excessive memory allocation. This exploitation can lead to severe memory exhaustion, potentially causing an Out-Of-Memory (OOM) kill and Denial-of-Service (DoS) for the Envoy proxy. The issue arises because the decompressor incorrectly places the inflation ratio limit check outside the inner execution loop, allowing malicious payloads to bypass safeguards and exhaust memory resources.
To address this vulnerability, Envoy operators should update to versions 1.35.13, 1.36.9, 1.37.5, or 1.38.3. If an immediate update is not possible, the Zstd decompressor can be disabled in the Envoy configuration, or operators can temporarily revert to other decompression methods like Gzip or Brotli, which do not have this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg | [email protected] | MitigationVendor AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.23.0, < 1.35.13 >= 1.36.0, < 1.36.9 >= 1.37.0, < 1.37.5 >= 1.38.0, < 1.38.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | [email protected] |