Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
Moderate severity
GitHub Reviewed
Published
Jun 5, 2026
in
envoyproxy/gateway
•
Updated Jul 16, 2026
Package
Affected versions
>= 1.8.0-rc.0, < 1.8.1
< 1.7.4
Patched versions
1.8.1
1.7.4
Description
Published to the GitHub Advisory Database
Jul 16, 2026
Reviewed
Jul 16, 2026
Last updated
Jul 16, 2026
Vulnerability report without repro case. Repro case may be added later after harness is complete.
Preconditions (4):
Description
getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops — persistent cross-tenant control-plane outage with PR:L/AC:L and scope change → HIGH despite availability-only.
References