High [CVE-2026-48044] Denial of Service via specially crafted zstd payload

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 until 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability has been identified in Envoy's zstd decompressor implementation (ZstdDecompressorImpl).

When zstd decompression is enabled, processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause severe memory exhaustion, potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy.

This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1. This vulnerability in Envoy's zstd decompressor is rated as Important, as a remote, unauthenticated attacker can induce a denial of service.

By sending a specially crafted zstd payload, an attacker can cause excessive memory allocation, leading to an Out-Of-Memory condition and service disruption for Envoy proxy instances deployed in Red Hat environments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift Service Mesh 3.0; Red Hat OpenShift Service Mesh 3.1; Red Hat OpenShift Service Mesh 3.2; Red Hat OpenShift Service Mesh 3.3; OpenShift Service Mesh 2.

Will not fix / out of support: OpenShift Service Mesh 2.