Envoy: unbounded buffering of mirror responses lets a client exhaust proxy memory

Impact

Envoy's async HTTP client buffers the response from a mirrored (shadow) request without a bound, so traffic that triggers large mirror responses can drive the proxy out of memory. On a GPU fleet the practical effect is that one tenant's traffic can OOM-kill a shared gateway or mesh sidecar and interrupt inference and model-pull paths for everyone behind it. Only configurations that use request mirroring are affected; no confidentiality or integrity impact is described.

Who can reach it

A client that can send requests through an Envoy route configured with a request mirror policy. Low privilege is required per the CVSS vector, so any authenticated tenant whose traffic traverses such a route qualifies.

What to do

Upgrade Envoy to a release carrying the fix from GHSA-xcj3-h7vf-fw26 and restart the proxies; the record does not name a fixed version, so take it from the advisory. As an interim step, remove or narrow request-mirror policies on externally reachable routes and set a memory limit on the proxy container so an OOM restarts one sidecar instead of destabilising the node.

References

Related entries

• Docker / moby: NULL pointer dereference in image_history crashes the daemonCVE-2024-36620 · Docker / mobyMedium
• Docker / moby: Race in the buildkit snapshot adapterCVE-2024-36621 · Docker / mobyMedium
• azure-file-csi-driver: Service account tokens disclosed in driver logsCVE-2024-3744 · azure-file-csi-driverMedium
• Envoy: External clients manipulate Envoy internal headers, reaching unauthorized behaviourCVE-2024-45806 · EnvoyMedium
• containers/storage: malicious image symlink causes Podman/Buildah/CRI-O to hang or OOM the hostCVE-2024-9676 · containers/storage (used by Podman, Buildah and CRI-O) - /etc/passwd symlink validation under --userns=autoMedium
• Headlamp: Credential caching in Headlamp when Helm is enabledCVE-2025-14269 · HeadlampMedium