Envoy: unauthenticated HTTP/2 cookie and HPACK decoded-size gap drives the proxy to OOM

Impact

An unauthenticated client speaking HTTP/2 to any Envoy listener can make the process allocate very large decoded header blocks while staying under the configured request header size limit, because cookie bytes are not fully counted and the oghttp2/quiche HPACK limit applies only to encoded bytes. The proxy is killed by the OOM reaper and traffic through it stops. On a GPU fleet this is the ingress and service-mesh data plane: an Envoy that dies takes inference endpoints, model gateways and mesh-internal calls with it, and in a sidecar deployment the blast radius is every pod sharing that sidecar. Red Hat ships the same fix for OpenShift Service Mesh 2.6 and 3.0 through 3.3.

Who can reach it

Anyone who can open an HTTP/2 connection to an Envoy downstream listener - typically the public internet or any tenant network that reaches the ingress. No authentication required.

What to do

Upgrade Envoy to 1.35.11, 1.36.7, 1.37.3 or 1.38.1, or apply the OpenShift Service Mesh errata (RHSA-2026:26210/26222/26231) and restart the proxies. Sidecar fleets need a rolling pod restart so each injected Envoy picks up the new image; no node reboot or GPU drain is needed. No complete workaround exists; interim mitigations named by the advisory are disabling downstream HTTP/2 where feasible, enforcing stricter header and cookie limits upstream of Envoy, and watching Envoy memory growth.

References

Related entries

• Podman: Image env var with a key and no value causes Podman to pass the host's value of that variableCVE-2026-57231 · PodmanHigh
• Envoy: stale RequestDecoder pointer after HTTP/3 stream recreation crashes the proxyCVE-2026-73512 · Envoy (HttpDatagramHandler, HTTP/3 Capsule Protocol)High
• Envoy: malformed upstream response trailers dispatch through a freed decoder and crash the proxyCVE-2026-73513 · Envoy (oghttp2 upstream HTTP/2 codec, ClientStreamImpl)High
• Envoy: null :path dereference in ext_authz query-parameter mutation crashes the proxyCVE-2026-73547 · Envoy ext_authz filter (query-parameter mutation on path-less CONNECT)High
• Envoy: request smuggling via non-WebSocket HTTP upgrade leaks responses to other clientsCVE-2026-73548 · Envoy (HTTP/1.1 upstream connection pool, non-WebSocket upgrade path)High
• Envoy: duplicate Host headers escape request header limits and let a client OOM-kill the proxyCVE-2026-73550 · Envoy (HTTP/2 duplicate Host header handling, header-limit accounting)High