CVE-2026-48044— Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
Quick assessment
Affected
envoyproxy envoy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Envoy Proxy Envoy是Envoy Proxy团队的应用网关。 Envoy Proxy Envoy 1.23.0版本至1.35.11之前版本、1.36.0版本至1.36.7之前版本、1.37.0版本至1.37.3之前版本和1.38.0版本至1.38.1之前版本存在资源管理错误漏洞，该漏洞源于zstd解压器实现问题，处理特制的高度压缩zstd有效载荷可能导致大量内存分配，攻击者利用此漏洞可造成严重内存耗尽，导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.1 |
affected |
>= 1.37.0, < 1.37.3 |
affected | ||
>= 1.36.0, < 1.36.7 |
affected | ||
>= 1.23.0, < 1.35.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48044
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
Source: CVE Program / CVE List V5
Vulnerability Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Vulnerability Title
Envoy Proxy Envoy 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Envoy Proxy Envoy是Envoy Proxy团队的应用网关。 Envoy Proxy Envoy 1.23.0版本至1.35.11之前版本、1.36.0版本至1.36.7之前版本、1.37.0版本至1.37.3之前版本和1.38.0版本至1.38.1之前版本存在资源管理错误漏洞，该漏洞源于zstd解压器实现问题，处理特制的高度压缩zstd有效载荷可能导致大量内存分配，攻击者利用此漏洞可造成严重内存耗尽，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.1 | - |
|
II. Public POCs for CVE-2026-48044
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48044
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48044 (1)
Same Patch Batch · envoyproxy · 2026-06-26 · 14 CVEs total
| CVE-2026-48743 | 7.5 HIGH | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Le |
| CVE-2026-48042 | 7.5 HIGH | Envoy: Stack overflow in destructor of highly nested JSON |
| CVE-2026-47220 | 7.5 HIGH | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format |
| CVE-2026-47775 | 6.8 MEDIUM | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption |
| CVE-2026-47204 | 6.5 MEDIUM | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes |
| CVE-2026-47207 | 6.5 MEDIUM | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message |
| CVE-2026-47221 | 5.9 MEDIUM | Envoy: Null pointer deref in internal redirects |
| CVE-2026-48497 | 5.9 MEDIUM | Envoy: Abnormal process termination in DNS UDP filter |
| CVE-2026-48706 | 5.9 MEDIUM | Envoy Heap Buffer Overflow in TcpStatsdSink |
| CVE-2026-47205 | 5.9 MEDIUM | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides |
| CVE-2026-48090 | 5.9 MEDIUM | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash r |
| CVE-2026-47692 | 4.8 MEDIUM | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-con |
| CVE-2026-47778 | 4.4 MEDIUM | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (A |
IV. Related Vulnerabilities
Same product: envoy
-
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when us -
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters -
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot seg -
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=ht -
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
Same vendor: envoyproxy
-
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when us -
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters -
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot seg -
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=ht -
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
Same weakness: CWE-409
-
CVE-2026-94637
Apache Thrift: Go `THeaderTransport` does not bound the infl -
CVE-2026-94636
Apache Thrift: Python `TZlibTransport` stops enforcing its d -
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClie -
CVE-2026-68911
Nicotine+: Decompression of peer messages can exhaust availa -
CVE-2026-92573
Apache Qpid Broker-J: Uncontrolled resource consumption duri
V. Comments for CVE-2026-48044
No comments yet