CVE-2026-47774: Envoy HTTP/2 Memory Exhaustion Denial of Service

Technical summary

The vulnerability arises from two interacting weaknesses in Envoy's HTTP/2 request processing. First, cookie header bytes are not fully counted during downstream header size validation, allowing them to slip past the intended size gate. Second, oghttp2/quiche enforces HPACK decompression limits only on the encoded bytes of the header block, not on the decoded size. A malicious HTTP/2 client can craft a compressed header block that appears small when encoded but decompresses to a massive structure. By exploiting the cookie-size-validation gap alongside the decoded-size gap, attackers can trigger multi-gigabyte allocations, overwhelming Envoy's memory and causing process termination.

Business impact

Envoy instances acting as edge proxies or service mesh sidecars become denial-of-service targets. Production Kubernetes clusters using Envoy for ingress or inter-service routing face sudden pod evictions and service interruptions. Organizations relying on Envoy for API gateways or load balancing will see unpredictable crashes during peak traffic if even a single malicious client connects. Recovery requires manual intervention and restarts, during which downstream services remain unreachable. The low barrier to exploitation (no credentials, no special network conditions) and the high blast radius for cloud-native infrastructure make this a critical operational risk.

Affected systems

Directly affected: Envoy proxy versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1. Indirectly affected: any deployment using these Envoy versions, including Red Hat OpenShift Service Mesh installations. Organizations running Envoy as a sidecar proxy, ingress controller, or standalone gateway are at risk. The vulnerability applies to HTTP/2 downstream connections; gRPC and other HTTP/2-dependent services traversing Envoy are relevant attack vectors.

Exploitability

Exploitation is straightforward and does not require authentication, valid credentials, or special network access. An attacker needs only to establish an HTTP/2 connection to an Envoy listener and send a malicious request with a crafted header block. The attack is deterministic and repeatable, making it suitable for both directed attacks and mass scanning. No user interaction or social engineering is needed; the condition can be triggered automatically. The low complexity and network-accessible attack surface yield a CVSS score of 7.5 (HIGH).

Remediation

The definitive fix is to upgrade Envoy to a patched version: 1.35.11 or later, 1.36.7 or later, 1.37.3 or later, or 1.38.1 or later (verify exact versions against the vendor advisory for your release track). Until patching is feasible, temporary mitigations include disabling HTTP/2 on downstream listeners where operationally acceptable, deploying external request header validation (WAF or edge proxy) to reject oversized or unusual cookie headers before traffic reaches Envoy, and implementing aggressive memory alerting to catch abnormal consumption early.

Patch guidance

Prioritize upgrades to patched Envoy versions immediately, especially for public-facing or multi-tenant deployments. Test patches in non-production environments to confirm compatibility with your configuration and workload. Rolling updates are preferred to avoid service gaps; monitor memory usage and latency during the rollout. For organizations unable to patch immediately, enable strict request header limits at the load balancer or WAF layer, and set up automated restart policies for Envoy pods that exceed memory thresholds.

Detection guidance

Monitor Envoy's memory usage for anomalous growth, particularly during or after HTTP/2 ingress traffic spikes. Correlate memory increases with unusual request patterns (e.g., requests with very long or heavily compressed headers). Log and alert on any HTTP/2 connection attempts with decompressed header sizes exceeding expected thresholds (e.g., >1 MB). Envoy's stats endpoint can expose memory allocation patterns; integrate these metrics into your observability stack. Network-level detection is difficult without payload inspection, so rely primarily on Envoy's own telemetry.

Why prioritize this

HIGH severity due to (1) unauthenticated remote triggering, (2) direct denial-of-service impact on critical infrastructure, (3) low attack complexity and broad applicability to cloud deployments, and (4) lack of complete workarounds. Any organization running Envoy in production should treat this as urgent. The combination of ease of exploitation and the centrality of proxies in modern application architectures elevates this beyond a typical DoS vulnerability.

Risk score, explained

CVSS 3.1 score of 7.5 reflects HIGH severity: Attack Vector Network (AV:N), no privileges required (PR:N), no user interaction (UI:N), and direct impact to Availability (A:H). The absence of Confidentiality or Integrity impact (C:N, I:N) keeps the score below 9.0, but the Availability damage is total—targeted instances will crash and require restart.

Frequently asked questions