CVE-2026-47774

Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification

HIGH

7.5

CVSS Score

Published: June 17, 2026 at 04:58 PM UTC

Updated: October 26, 2026 at 11:10 AM UTC

2 products affected across 2 vendorsEnvoyOpenShift Service Mesh

Using envoy by envoyproxy?

Get instant alerts when new vulnerabilities affect envoy - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1.0%

SSVC

No known exploit

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Envoy · Envoyproxy

95%

v < 1.35.111.36.0 ≤ v < 1.36.71.37.0 ≤ v < 1.37.31.38.0

Affected range stops below 1.35.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.36.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.37.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.38.1, so it looks safe — our inference, not a vendor statement

OpenShift Service Mesh · Red Hatcontainer

95%

2.6 ≤ v < 2.6.173.0 ≤ v < 3.0.123.1 ≤ v < 3.1.93.2 ≤ v < 3.2.63.3 ≤ v < 3.3.4

Vendor states this is fixed in 1781069908 (unaffected)

Vendor states this is fixed in 1781070158 (unaffected)

Vendor states this is fixed in 1781070967 (unaffected)

Vendor states this is fixed in 1781094520 (unaffected)

Vendor states this is fixed in 1781604724 (unaffected)

Affected range stops below 2.6.17, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.1.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.3.4, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (10)

x_refsource_CONFIRMMitigationVendor Advisory

Source: cverecord

https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8

Mailing ListMitigationThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/06/04/15

Third Party Advisory