CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48044

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl). When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.005

EPSS Ranking 36.6%

CVSS Severity

CVSS v3 Score 7.5

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg

Products affected by CVE-2026-48044

Envoyproxy » Envoy » Version: 1.23.0

cpe:2.3:a:envoyproxy:envoy:1.23.0
Envoyproxy » Envoy » Version: 1.23.1

cpe:2.3:a:envoyproxy:envoy:1.23.1
Envoyproxy » Envoy » Version: 1.23.10

cpe:2.3:a:envoyproxy:envoy:1.23.10
Envoyproxy » Envoy » Version: 1.23.11

cpe:2.3:a:envoyproxy:envoy:1.23.11
Envoyproxy » Envoy » Version: 1.23.12

cpe:2.3:a:envoyproxy:envoy:1.23.12
Envoyproxy » Envoy » Version: 1.23.2

cpe:2.3:a:envoyproxy:envoy:1.23.2
Envoyproxy » Envoy » Version: 1.23.3

cpe:2.3:a:envoyproxy:envoy:1.23.3
Envoyproxy » Envoy » Version: 1.23.4

cpe:2.3:a:envoyproxy:envoy:1.23.4
Envoyproxy » Envoy » Version: 1.23.5

cpe:2.3:a:envoyproxy:envoy:1.23.5
Envoyproxy » Envoy » Version: 1.23.6

cpe:2.3:a:envoyproxy:envoy:1.23.6
Envoyproxy » Envoy » Version: 1.23.7

cpe:2.3:a:envoyproxy:envoy:1.23.7
Envoyproxy » Envoy » Version: 1.23.8

cpe:2.3:a:envoyproxy:envoy:1.23.8
Envoyproxy » Envoy » Version: 1.23.9

cpe:2.3:a:envoyproxy:envoy:1.23.9
Envoyproxy » Envoy » Version: 1.24.0

cpe:2.3:a:envoyproxy:envoy:1.24.0
Envoyproxy » Envoy » Version: 1.24.1

cpe:2.3:a:envoyproxy:envoy:1.24.1
Envoyproxy » Envoy » Version: 1.24.10

cpe:2.3:a:envoyproxy:envoy:1.24.10
Envoyproxy » Envoy » Version: 1.24.11

cpe:2.3:a:envoyproxy:envoy:1.24.11
Envoyproxy » Envoy » Version: 1.24.12

cpe:2.3:a:envoyproxy:envoy:1.24.12
Envoyproxy » Envoy » Version: 1.24.2

cpe:2.3:a:envoyproxy:envoy:1.24.2
Envoyproxy » Envoy » Version: 1.24.3

cpe:2.3:a:envoyproxy:envoy:1.24.3
Envoyproxy » Envoy » Version: 1.24.4

cpe:2.3:a:envoyproxy:envoy:1.24.4
Envoyproxy » Envoy » Version: 1.24.5

cpe:2.3:a:envoyproxy:envoy:1.24.5
Envoyproxy » Envoy » Version: 1.24.6

cpe:2.3:a:envoyproxy:envoy:1.24.6
Envoyproxy » Envoy » Version: 1.24.7

cpe:2.3:a:envoyproxy:envoy:1.24.7
Envoyproxy » Envoy » Version: 1.24.8

cpe:2.3:a:envoyproxy:envoy:1.24.8
Envoyproxy » Envoy » Version: 1.24.9

cpe:2.3:a:envoyproxy:envoy:1.24.9
Envoyproxy » Envoy » Version: 1.25.0

cpe:2.3:a:envoyproxy:envoy:1.25.0
Envoyproxy » Envoy » Version: 1.25.1

cpe:2.3:a:envoyproxy:envoy:1.25.1
Envoyproxy » Envoy » Version: 1.25.10

cpe:2.3:a:envoyproxy:envoy:1.25.10
Envoyproxy » Envoy » Version: 1.25.11

cpe:2.3:a:envoyproxy:envoy:1.25.11
Envoyproxy » Envoy » Version: 1.25.2

cpe:2.3:a:envoyproxy:envoy:1.25.2
Envoyproxy » Envoy » Version: 1.25.3

cpe:2.3:a:envoyproxy:envoy:1.25.3
Envoyproxy » Envoy » Version: 1.25.4

cpe:2.3:a:envoyproxy:envoy:1.25.4
Envoyproxy » Envoy » Version: 1.25.5

cpe:2.3:a:envoyproxy:envoy:1.25.5
Envoyproxy » Envoy » Version: 1.25.6

cpe:2.3:a:envoyproxy:envoy:1.25.6
Envoyproxy » Envoy » Version: 1.25.7

cpe:2.3:a:envoyproxy:envoy:1.25.7
Envoyproxy » Envoy » Version: 1.25.8

cpe:2.3:a:envoyproxy:envoy:1.25.8
Envoyproxy » Envoy » Version: 1.25.9

cpe:2.3:a:envoyproxy:envoy:1.25.9
Envoyproxy » Envoy » Version: 1.26.0

cpe:2.3:a:envoyproxy:envoy:1.26.0
Envoyproxy » Envoy » Version: 1.26.1

cpe:2.3:a:envoyproxy:envoy:1.26.1
Envoyproxy » Envoy » Version: 1.26.2

cpe:2.3:a:envoyproxy:envoy:1.26.2
Envoyproxy » Envoy » Version: 1.26.3

cpe:2.3:a:envoyproxy:envoy:1.26.3
Envoyproxy » Envoy » Version: 1.26.4

cpe:2.3:a:envoyproxy:envoy:1.26.4
Envoyproxy » Envoy » Version: 1.26.5

cpe:2.3:a:envoyproxy:envoy:1.26.5
Envoyproxy » Envoy » Version: 1.26.6

cpe:2.3:a:envoyproxy:envoy:1.26.6
Envoyproxy » Envoy » Version: 1.26.7

cpe:2.3:a:envoyproxy:envoy:1.26.7
Envoyproxy » Envoy » Version: 1.26.8

cpe:2.3:a:envoyproxy:envoy:1.26.8
Envoyproxy » Envoy » Version: 1.27.0

cpe:2.3:a:envoyproxy:envoy:1.27.0
Envoyproxy » Envoy » Version: 1.27.1

cpe:2.3:a:envoyproxy:envoy:1.27.1
Envoyproxy » Envoy » Version: 1.27.2

cpe:2.3:a:envoyproxy:envoy:1.27.2
Envoyproxy » Envoy » Version: 1.27.3

cpe:2.3:a:envoyproxy:envoy:1.27.3
Envoyproxy » Envoy » Version: 1.27.4

cpe:2.3:a:envoyproxy:envoy:1.27.4
Envoyproxy » Envoy » Version: 1.27.5

cpe:2.3:a:envoyproxy:envoy:1.27.5
Envoyproxy » Envoy » Version: 1.27.6

cpe:2.3:a:envoyproxy:envoy:1.27.6
Envoyproxy » Envoy » Version: 1.27.7

cpe:2.3:a:envoyproxy:envoy:1.27.7
Envoyproxy » Envoy » Version: 1.28.0

cpe:2.3:a:envoyproxy:envoy:1.28.0
Envoyproxy » Envoy » Version: 1.28.1

cpe:2.3:a:envoyproxy:envoy:1.28.1
Envoyproxy » Envoy » Version: 1.28.2

cpe:2.3:a:envoyproxy:envoy:1.28.2
Envoyproxy » Envoy » Version: 1.28.3

cpe:2.3:a:envoyproxy:envoy:1.28.3
Envoyproxy » Envoy » Version: 1.28.4

cpe:2.3:a:envoyproxy:envoy:1.28.4
Envoyproxy » Envoy » Version: 1.28.5

cpe:2.3:a:envoyproxy:envoy:1.28.5
Envoyproxy » Envoy » Version: 1.28.6

cpe:2.3:a:envoyproxy:envoy:1.28.6
Envoyproxy » Envoy » Version: 1.28.7

cpe:2.3:a:envoyproxy:envoy:1.28.7
Envoyproxy » Envoy » Version: 1.29.0

cpe:2.3:a:envoyproxy:envoy:1.29.0
Envoyproxy » Envoy » Version: 1.29.1

cpe:2.3:a:envoyproxy:envoy:1.29.1
Envoyproxy » Envoy » Version: 1.29.10

cpe:2.3:a:envoyproxy:envoy:1.29.10
Envoyproxy » Envoy » Version: 1.29.11

cpe:2.3:a:envoyproxy:envoy:1.29.11
Envoyproxy » Envoy » Version: 1.29.12

cpe:2.3:a:envoyproxy:envoy:1.29.12
Envoyproxy » Envoy » Version: 1.29.2

cpe:2.3:a:envoyproxy:envoy:1.29.2
Envoyproxy » Envoy » Version: 1.29.3

cpe:2.3:a:envoyproxy:envoy:1.29.3
Envoyproxy » Envoy » Version: 1.29.4

cpe:2.3:a:envoyproxy:envoy:1.29.4
Envoyproxy » Envoy » Version: 1.29.5

cpe:2.3:a:envoyproxy:envoy:1.29.5
Envoyproxy » Envoy » Version: 1.29.6

cpe:2.3:a:envoyproxy:envoy:1.29.6
Envoyproxy » Envoy » Version: 1.29.7

cpe:2.3:a:envoyproxy:envoy:1.29.7
Envoyproxy » Envoy » Version: 1.29.8

cpe:2.3:a:envoyproxy:envoy:1.29.8
Envoyproxy » Envoy » Version: 1.29.9

cpe:2.3:a:envoyproxy:envoy:1.29.9
Envoyproxy » Envoy » Version: 1.30.0

cpe:2.3:a:envoyproxy:envoy:1.30.0
Envoyproxy » Envoy » Version: 1.30.1

cpe:2.3:a:envoyproxy:envoy:1.30.1
Envoyproxy » Envoy » Version: 1.30.10

cpe:2.3:a:envoyproxy:envoy:1.30.10
Envoyproxy » Envoy » Version: 1.30.11

cpe:2.3:a:envoyproxy:envoy:1.30.11
Envoyproxy » Envoy » Version: 1.30.2

cpe:2.3:a:envoyproxy:envoy:1.30.2
Envoyproxy » Envoy » Version: 1.30.3

cpe:2.3:a:envoyproxy:envoy:1.30.3
Envoyproxy » Envoy » Version: 1.30.4

cpe:2.3:a:envoyproxy:envoy:1.30.4
Envoyproxy » Envoy » Version: 1.30.5

cpe:2.3:a:envoyproxy:envoy:1.30.5
Envoyproxy » Envoy » Version: 1.30.6

cpe:2.3:a:envoyproxy:envoy:1.30.6
Envoyproxy » Envoy » Version: 1.30.7

cpe:2.3:a:envoyproxy:envoy:1.30.7
Envoyproxy » Envoy » Version: 1.30.8

cpe:2.3:a:envoyproxy:envoy:1.30.8
Envoyproxy » Envoy » Version: 1.30.9

cpe:2.3:a:envoyproxy:envoy:1.30.9
Envoyproxy » Envoy » Version: 1.31.0

cpe:2.3:a:envoyproxy:envoy:1.31.0
Envoyproxy » Envoy » Version: 1.31.1

cpe:2.3:a:envoyproxy:envoy:1.31.1
Envoyproxy » Envoy » Version: 1.31.10

cpe:2.3:a:envoyproxy:envoy:1.31.10
Envoyproxy » Envoy » Version: 1.31.2

cpe:2.3:a:envoyproxy:envoy:1.31.2
Envoyproxy » Envoy » Version: 1.31.3

cpe:2.3:a:envoyproxy:envoy:1.31.3
Envoyproxy » Envoy » Version: 1.31.4

cpe:2.3:a:envoyproxy:envoy:1.31.4
Envoyproxy » Envoy » Version: 1.31.5

cpe:2.3:a:envoyproxy:envoy:1.31.5
Envoyproxy » Envoy » Version: 1.31.6

cpe:2.3:a:envoyproxy:envoy:1.31.6
Envoyproxy » Envoy » Version: 1.31.7

cpe:2.3:a:envoyproxy:envoy:1.31.7
Envoyproxy » Envoy » Version: 1.31.8

cpe:2.3:a:envoyproxy:envoy:1.31.8
Envoyproxy » Envoy » Version: 1.31.9

cpe:2.3:a:envoyproxy:envoy:1.31.9
Envoyproxy » Envoy » Version: 1.32.0

cpe:2.3:a:envoyproxy:envoy:1.32.0
Envoyproxy » Envoy » Version: 1.32.1

cpe:2.3:a:envoyproxy:envoy:1.32.1
Envoyproxy » Envoy » Version: 1.32.10

cpe:2.3:a:envoyproxy:envoy:1.32.10
Envoyproxy » Envoy » Version: 1.32.11

cpe:2.3:a:envoyproxy:envoy:1.32.11
Envoyproxy » Envoy » Version: 1.32.12

cpe:2.3:a:envoyproxy:envoy:1.32.12
Envoyproxy » Envoy » Version: 1.32.13

cpe:2.3:a:envoyproxy:envoy:1.32.13
Envoyproxy » Envoy » Version: 1.32.2

cpe:2.3:a:envoyproxy:envoy:1.32.2
Envoyproxy » Envoy » Version: 1.32.3

cpe:2.3:a:envoyproxy:envoy:1.32.3
Envoyproxy » Envoy » Version: 1.32.4

cpe:2.3:a:envoyproxy:envoy:1.32.4
Envoyproxy » Envoy » Version: 1.32.5

cpe:2.3:a:envoyproxy:envoy:1.32.5
Envoyproxy » Envoy » Version: 1.32.6

cpe:2.3:a:envoyproxy:envoy:1.32.6
Envoyproxy » Envoy » Version: 1.32.7

cpe:2.3:a:envoyproxy:envoy:1.32.7
Envoyproxy » Envoy » Version: 1.32.8

cpe:2.3:a:envoyproxy:envoy:1.32.8
Envoyproxy » Envoy » Version: 1.32.9

cpe:2.3:a:envoyproxy:envoy:1.32.9
Envoyproxy » Envoy » Version: 1.33.0

cpe:2.3:a:envoyproxy:envoy:1.33.0
Envoyproxy » Envoy » Version: 1.33.1

cpe:2.3:a:envoyproxy:envoy:1.33.1
Envoyproxy » Envoy » Version: 1.33.10

cpe:2.3:a:envoyproxy:envoy:1.33.10
Envoyproxy » Envoy » Version: 1.33.11

cpe:2.3:a:envoyproxy:envoy:1.33.11
Envoyproxy » Envoy » Version: 1.33.12

cpe:2.3:a:envoyproxy:envoy:1.33.12
Envoyproxy » Envoy » Version: 1.33.13

cpe:2.3:a:envoyproxy:envoy:1.33.13
Envoyproxy » Envoy » Version: 1.33.14

cpe:2.3:a:envoyproxy:envoy:1.33.14
Envoyproxy » Envoy » Version: 1.33.2

cpe:2.3:a:envoyproxy:envoy:1.33.2
Envoyproxy » Envoy » Version: 1.33.3

cpe:2.3:a:envoyproxy:envoy:1.33.3
Envoyproxy » Envoy » Version: 1.33.4

cpe:2.3:a:envoyproxy:envoy:1.33.4
Envoyproxy » Envoy » Version: 1.33.5

cpe:2.3:a:envoyproxy:envoy:1.33.5
Envoyproxy » Envoy » Version: 1.33.6

cpe:2.3:a:envoyproxy:envoy:1.33.6
Envoyproxy » Envoy » Version: 1.33.7

cpe:2.3:a:envoyproxy:envoy:1.33.7
Envoyproxy » Envoy » Version: 1.33.8

cpe:2.3:a:envoyproxy:envoy:1.33.8
Envoyproxy » Envoy » Version: 1.33.9

cpe:2.3:a:envoyproxy:envoy:1.33.9
Envoyproxy » Envoy » Version: 1.34.0

cpe:2.3:a:envoyproxy:envoy:1.34.0
Envoyproxy » Envoy » Version: 1.34.1

cpe:2.3:a:envoyproxy:envoy:1.34.1
Envoyproxy » Envoy » Version: 1.34.10

cpe:2.3:a:envoyproxy:envoy:1.34.10
Envoyproxy » Envoy » Version: 1.34.11

cpe:2.3:a:envoyproxy:envoy:1.34.11
Envoyproxy » Envoy » Version: 1.34.12

cpe:2.3:a:envoyproxy:envoy:1.34.12
Envoyproxy » Envoy » Version: 1.34.13

cpe:2.3:a:envoyproxy:envoy:1.34.13
Envoyproxy » Envoy » Version: 1.34.14

cpe:2.3:a:envoyproxy:envoy:1.34.14
Envoyproxy » Envoy » Version: 1.34.2

cpe:2.3:a:envoyproxy:envoy:1.34.2
Envoyproxy » Envoy » Version: 1.34.3

cpe:2.3:a:envoyproxy:envoy:1.34.3
Envoyproxy » Envoy » Version: 1.34.4

cpe:2.3:a:envoyproxy:envoy:1.34.4
Envoyproxy » Envoy » Version: 1.34.5

cpe:2.3:a:envoyproxy:envoy:1.34.5
Envoyproxy » Envoy » Version: 1.34.6

cpe:2.3:a:envoyproxy:envoy:1.34.6
Envoyproxy » Envoy » Version: 1.34.7

cpe:2.3:a:envoyproxy:envoy:1.34.7
Envoyproxy » Envoy » Version: 1.34.8

cpe:2.3:a:envoyproxy:envoy:1.34.8
Envoyproxy » Envoy » Version: 1.34.9

cpe:2.3:a:envoyproxy:envoy:1.34.9
Envoyproxy » Envoy » Version: 1.35.0

cpe:2.3:a:envoyproxy:envoy:1.35.0
Envoyproxy » Envoy » Version: 1.35.1

cpe:2.3:a:envoyproxy:envoy:1.35.1
Envoyproxy » Envoy » Version: 1.35.10

cpe:2.3:a:envoyproxy:envoy:1.35.10
Envoyproxy » Envoy » Version: 1.35.11

cpe:2.3:a:envoyproxy:envoy:1.35.11
Envoyproxy » Envoy » Version: 1.35.12

cpe:2.3:a:envoyproxy:envoy:1.35.12
Envoyproxy » Envoy » Version: 1.35.2

cpe:2.3:a:envoyproxy:envoy:1.35.2
Envoyproxy » Envoy » Version: 1.35.3

cpe:2.3:a:envoyproxy:envoy:1.35.3
Envoyproxy » Envoy » Version: 1.35.4

cpe:2.3:a:envoyproxy:envoy:1.35.4
Envoyproxy » Envoy » Version: 1.35.5

cpe:2.3:a:envoyproxy:envoy:1.35.5
Envoyproxy » Envoy » Version: 1.35.6

cpe:2.3:a:envoyproxy:envoy:1.35.6
Envoyproxy » Envoy » Version: 1.35.7

cpe:2.3:a:envoyproxy:envoy:1.35.7
Envoyproxy » Envoy » Version: 1.35.8

cpe:2.3:a:envoyproxy:envoy:1.35.8
Envoyproxy » Envoy » Version: 1.35.9

cpe:2.3:a:envoyproxy:envoy:1.35.9
Envoyproxy » Envoy » Version: 1.36.0

cpe:2.3:a:envoyproxy:envoy:1.36.0
Envoyproxy » Envoy » Version: 1.36.1

cpe:2.3:a:envoyproxy:envoy:1.36.1
Envoyproxy » Envoy » Version: 1.36.2

cpe:2.3:a:envoyproxy:envoy:1.36.2
Envoyproxy » Envoy » Version: 1.36.3

cpe:2.3:a:envoyproxy:envoy:1.36.3
Envoyproxy » Envoy » Version: 1.36.4

cpe:2.3:a:envoyproxy:envoy:1.36.4
Envoyproxy » Envoy » Version: 1.36.5

cpe:2.3:a:envoyproxy:envoy:1.36.5
Envoyproxy » Envoy » Version: 1.36.6

cpe:2.3:a:envoyproxy:envoy:1.36.6
Envoyproxy » Envoy » Version: 1.36.7

cpe:2.3:a:envoyproxy:envoy:1.36.7
Envoyproxy » Envoy » Version: 1.36.8

cpe:2.3:a:envoyproxy:envoy:1.36.8
Envoyproxy » Envoy » Version: 1.37.0

cpe:2.3:a:envoyproxy:envoy:1.37.0
Envoyproxy » Envoy » Version: 1.37.1

cpe:2.3:a:envoyproxy:envoy:1.37.1
Envoyproxy » Envoy » Version: 1.37.2

cpe:2.3:a:envoyproxy:envoy:1.37.2
Envoyproxy » Envoy » Version: 1.37.3

cpe:2.3:a:envoyproxy:envoy:1.37.3
Envoyproxy » Envoy » Version: 1.37.4

cpe:2.3:a:envoyproxy:envoy:1.37.4
Envoyproxy » Envoy » Version: 1.38.0

cpe:2.3:a:envoyproxy:envoy:1.38.0
Envoyproxy » Envoy » Version: 1.38.1

cpe:2.3:a:envoyproxy:envoy:1.38.1
Envoyproxy » Envoy » Version: 1.38.2

cpe:2.3:a:envoyproxy:envoy:1.38.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-48044

Products

Pricing

Contact Us