Skip to content
Fencer Vulns
high 7.5

CVE-2026-47774 json

Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

published 2026-06-17 4 mo ago modified 2026-10-26 14 d ago also BIT-envoy-2026-47774 , EUVD-2026-37765 , GHSA-22m2-hvr2-xqc8

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.

Patch / fix

  • bitnami envoy 1.35.11, 1.36.7, 1.37.3, 1.38.1
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1781604724
  • Red Hat Red Hat OpenShift Service Mesh 3.0 1781069908
  • Red Hat Red Hat OpenShift Service Mesh 3.1 1781070158
  • Red Hat Red Hat OpenShift Service Mesh 3.2 1781070967
  • Red Hat Red Hat OpenShift Service Mesh 3.3 1781094520

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-47774 updated cvss 7.5

envoy: envoy: HTTP/2 Remote Denial of Service via HPACK compression bomb and Slowloris-style attack

  • Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh/proxyv2-rhel9 1781604724
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:27114
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/istio-proxyv2-rhel9 1781069908
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:26210
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/istio-proxyv2-rhel9 1781070158
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:26222
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/istio-proxyv2-rhel9 1781070967
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:26231
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/istio-proxyv2-rhel9 1781094520
    fixed: vendor fix “See the security bulletin for a detailed mitigation procedure.” RHSA-2026:26247
  • Red Hat OpenShift Service Mesh 2.6 openshift-service-mesh/istio-must-gather-rhel9 1781579930 Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/istio-cni-rhel9 1780406943, openshift-service-mesh/istio-pilot-rhel9 1780406629, openshift-service-mesh/istio-rhel9-operator 1780525188, openshift-service-mesh/istio-must-gather-rhel9 1780406549, openshift-service-mesh/istio-sail-operator-bundle 1781073616, openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 1780454966 Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/istio-cni-rhel9 1780409215, openshift-service-mesh/istio-pilot-rhel9 1780408152, openshift-service-mesh/istio-rhel9-operator 1780513369, openshift-service-mesh/istio-must-gather-rhel9 1780408612, openshift-service-mesh/istio-sail-operator-bundle 1781073729, openshift-service-mesh-tech-preview/istio-ztunnel-rhel9 1780909004 Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/istio-cni-rhel9 1780908312, openshift-service-mesh/istio-pilot-rhel9 1780404981, openshift-service-mesh/istio-ztunnel-rhel9 1780908877, openshift-service-mesh/istio-rhel9-operator 1780512461, openshift-service-mesh/istio-must-gather-rhel9 1780404600, openshift-service-mesh/istio-sail-operator-bundle 1781074455 Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/istio-cni-rhel9 1781093422, openshift-service-mesh/istio-pilot-rhel9 1781093362, openshift-service-mesh/istio-ztunnel-rhel9 1781094215, openshift-service-mesh/istio-rhel9-operator 1781093343, openshift-service-mesh/istio-must-gather-rhel9 1780424801, openshift-service-mesh/istio-sail-operator-bundle 1781098162
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2487465 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami envoy
<1.35.11
>=1.36.0, <1.36.7
>=1.37.0, <1.37.3
>=1.38.0, <1.38.1
1.35.11
1.36.7
1.37.3
1.38.1

Affected products

  • envoyproxy envoy
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3

Classification

Weakness
  • CWE-405 Asymmetric Resource Consumption (Amplification)
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.