CVE-2026-48044: Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosion
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envoy Zstd Decompressor (ZstdDecompressorImpl)to a version that resolves this vulnerability.Fixed in 1.35.11 - Upgrade
Upgrade
Envoy Zstd Decompressor (ZstdDecompressorImpl)to a version that resolves this vulnerability.Fixed in 1.36.7 - Upgrade
Upgrade
Envoy Zstd Decompressor (ZstdDecompressorImpl)to a version that resolves this vulnerability.Fixed in 1.37.3 - Upgrade
Upgrade
Envoy Zstd Decompressor (ZstdDecompressorImpl)to a version that resolves this vulnerability.Fixed in 1.38.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48044?
The severity of CVE-2026-48044 is rated high, with a score of 7.5.
How do I fix CVE-2026-48044?
To fix CVE-2026-48044, update Envoy to a version that addresses the vulnerability, specifically versions 1.35.12 and later.
What components are affected by CVE-2026-48044?
CVE-2026-48044 affects the zstd decompressor implementation in Envoy versions 1.23.0 through 1.38.1.
What is the impact of CVE-2026-48044 if exploited?
Exploitation of CVE-2026-48044 can lead to a memory explosion, potentially causing denial of service.
Is there a workaround for CVE-2026-48044 until a patch is applied?
A temporary workaround for CVE-2026-48044 is to disable zstd decompression in Envoy until the software is updated.