VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Sep 14, 2026· Updated Sep 15, 2026

CVE-2026-53715

CVE-2026-53715

Description

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/envoyproxy/gatewayGo
>= 1.8.0-rc.0, < 1.8.11.8.1
github.com/envoyproxy/gatewayGo
< 1.7.41.7.4

Affected products

36

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.