CVE-2026-48044

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 23, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.49% · Oct 25, 2026

A flaw was found in Envoy, an open source edge and service proxy. A remote attacker can exploit this vulnerability by sending a specially crafted, highly compressed zstd payload to an Envoy proxy with zstd decompression enabled. This can lead to massive memory allocation, causing severe memory exhaustion and potentially resulting in an Out-Of-Memory (OOM) kill and Denial of Service (DoS) for the Envoy proxy. Envoy: Envoy: Denial of Service via specially crafted zstd payload This vulnerability in Envoy's zstd decompressor is rated as Important, as a remote, unauthenticated attacker can induce a denial of service. By sending a specially crafted zstd payload, an attacker can cause excessive memory allocation, leading to an Out-Of-Memory condition and service disruption for Envoy proxy instances deployed in Red Hat environments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.