CVE-2026-47774

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.

• CWE-405
• CWE-770
• CWE-409

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8Mitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/06/04/15Mailing List, Mitigation, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:26210Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:26222Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:26231Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:26247Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:27114Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-47774Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2487465Exploit, Issue Tracking, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47774.jsonThird Party Advisory

Published

Jun 17, 2026

Last Modified

Jul 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47765Frappe is a full-stack web application framework. Prior to 1…7.1
• CVE-2026-47767Symfony is a PHP framework for web and console applications …9.8
• CVE-2026-47768nebula-mesh is a self-hosted control plane for Slack Nebula …5.5
• CVE-2026-47769APIFold reads an OpenAPI 3.x or Swagger 2.x specification an…5.3
• CVE-2026-4777A security flaw has been discovered in SourceCodester Sales …6.5
• CVE-2026-47770jq is a command-line JSON processor. Prior to 1.8.2, compari…5.5
• CVE-2026-47775Envoy is an open source edge and service proxy designed for …6.8
• CVE-2026-47777Mastodon is a free, open-source social network server based …7.5
• CVE-2026-47778Envoy is an open source edge and service proxy designed for …4.4
• CVE-2026-4778A weakness has been identified in SourceCodester Sales and I…6.5
• CVE-2026-47781PDM is a Python package and dependency manager. In versions …8.4
• CVE-2026-47782Android App "RoboForm Password Manager" provided by Siber Sy…4.6