Envoy Gateway: unbounded gzip decompression of a tenant-supplied Wasm URL OOM-kills the shared controller

Impact

getFileFromGZ calls io.ReadAll on a gzip.Reader with no limit on the decompressed size. The 256 MiB cap applies only to the compressed input and the optional sha256 check runs after decompression, so a small gzip stream expands into a multi-gigabyte allocation inside the shared Envoy Gateway controller. There is no operator allowlist for Wasm URLs, so any tenant permitted to create an EnvoyExtensionPolicy can point spec.wasm[].code.http.url at a payload it controls. The controller is killed by the OOM killer, restarts, re-reconciles the still-present custom resource and crash-loops, which is a cross-tenant control-plane outage rather than a single-namespace problem: no new routes, no new backends, no config changes for anyone until an administrator finds and deletes the object. On a GPU cluster that means inference endpoints cannot be published or moved while nodes are being drained or replaced.

Who can reach it

Any authenticated tenant with RBAC to create or edit an EnvoyExtensionPolicy in its own namespace, plus a compressed Wasm payload at a URL the controller can reach.

What to do

Upgrade Envoy Gateway to 1.7.4 or 1.8.1 and restart the controller deployment; the data plane keeps serving the last good config during the rollout. Until then, restrict who may create EnvoyExtensionPolicy objects and use egress policy to limit which hosts the controller can fetch Wasm from. Clearing an in-flight incident requires deleting the offending custom resource, otherwise the restarted controller crash-loops again.

References

Related entries

• Envoy Gateway: tar header size is trusted before validation, so one OCI Wasm layer crash-loops the controllerCVE-2026-53717 · Envoy Gateway control plane (OCI Wasm image fetcher, extractWasmPluginBinary)Medium
• Envoy Gateway: a SecurityPolicy on a TCPRoute without spec.authorization panics translation and stalls xDSCVE-2026-53719 · Envoy Gateway control plane (translateSecurityPolicyForRoute, SecurityPolicy on TCPRoute)Medium
• doco-cd: artifact-supplied config can turn off its own signature verification, bypassing OCI trust policyCVE-2026-54248 · doco-cd (GitOps controller, OCI artifact signature verification)Medium
• KubeEdge CloudHub: unvalidated 32-bit payload length lets an edge peer exhaust control-plane memoryCVE-2026-62370 · KubeEdge CloudHub viaduct packer (PackageHeader.PayloadLen)Medium
• Submariner: IPsec pre-shared key stored unencrypted in the Submariner custom resourceCVE-2026-66781 · Submariner operator (Submariner CR, IPsec pre-shared key)Medium
• KubeSphere cluster-controller: Cluster CRD endpoint is fetched unvalidated, giving SSRF from the controller podCVE-2026-71208 · KubeSphere cluster-controller (Cluster CRD connection config, addCluster / Discovery.ServerVersion)Medium