CVE-2026-48044— Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.1 | affected |
>= 1.37.0, < 1.37.3 | affected | ||
>= 1.36.0, < 1.36.7 | affected | ||
>= 1.23.0, < 1.35.11 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48044
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
Source: CVE Program / CVE List V5
Vulnerability Description
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: CVE Program / CVE List V5
Vulnerability Title
Envoy Proxy Envoy 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Envoy Proxy Envoy是Envoy Proxy团队的应用网关。 Envoy Proxy Envoy 1.23.0版本至1.35.11之前版本、1.36.0版本至1.36.7之前版本、1.37.0版本至1.37.3之前版本和1.38.0版本至1.38.1之前版本存在资源管理错误漏洞，该漏洞源于zstd解压器实现问题，处理特制的高度压缩zstd有效载荷可能导致大量内存分配，攻击者利用此漏洞可造成严重内存耗尽，导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.1 | - |
II. Public POCs for CVE-2026-48044
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48044
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48044 (1)
Same Patch Batch · envoyproxy · 2026-06-26 · 14 CVEs total
| CVE-2026-48743 | 7.5 HIGH | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Le |
| CVE-2026-48042 | 7.5 HIGH | Envoy: Stack overflow in destructor of highly nested JSON |
| CVE-2026-47220 | 7.5 HIGH | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log format |
| CVE-2026-47775 | 6.8 MEDIUM | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryption |
| CVE-2026-47204 | 6.5 MEDIUM | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routes |
| CVE-2026-47207 | 6.5 MEDIUM | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message |
| CVE-2026-47221 | 5.9 MEDIUM | Envoy: Null pointer deref in internal redirects |
| CVE-2026-48497 | 5.9 MEDIUM | Envoy: Abnormal process termination in DNS UDP filter |
| CVE-2026-48706 | 5.9 MEDIUM | Envoy Heap Buffer Overflow in TcpStatsdSink |
| CVE-2026-47205 | 5.9 MEDIUM | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides |
| CVE-2026-48090 | 5.9 MEDIUM | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash r |
| CVE-2026-47692 | 4.8 MEDIUM | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-con |
| CVE-2026-47778 | 4.4 MEDIUM | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (A |
IV. Related Vulnerabilities
Same product: envoy
- CVE-2026-48090
Envoy HTTP: OAuth2 filter late async token completion after - CVE-2026-47220
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% - CVE-2026-47205
Envoy: ext_authz Use-After-Free during Stream Teardown with - CVE-2026-47692
Envoy: PROXY Protocol v2 header generator emits "skipped" TL - CVE-2026-47207
Envoy crashes if multiple unexpected ext_proc responses are
Same vendor: envoyproxy
- CVE-2026-48090
Envoy HTTP: OAuth2 filter late async token completion after - CVE-2026-47220
Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% - CVE-2026-47205
Envoy: ext_authz Use-After-Free during Stream Teardown with - CVE-2026-47692
Envoy: PROXY Protocol v2 header generator emits "skipped" TL - CVE-2026-47207
Envoy crashes if multiple unexpected ext_proc responses are
Same weakness: CWE-409
- CVE-2026-14298
Denial of service via resource exhaustion in Mattermost - CVE-2026-73232
ffuf denial of service (OOM) via HTTP response decompression - CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decom - CVE-2026-10819
Mattermost Server Denial of Service via Animated GIF Emoji U - CVE-2026-49158
Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
V. Comments for CVE-2026-48044
No comments yet