Skip to content
Heist/ feed
Back to feed
Medium

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

Type: advisorySources: OSV

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-53715
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 21:16 UTC · Revision 1

Source evidence

Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock

core-osv · Original source

Published 14 Sept 2026, 20:14 UTC

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.

osv:CVE-2026-53715
Complete source record
{
  "id": "82de1b23e2f215821b1538dec3d30c9669d4b4a9679033e145fd9057855f2a5e",
  "url": "https://osv.dev/vulnerability/CVE-2026-53715",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock",
    "summary": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1.",
    "evidence": "osv:CVE-2026-53715",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-53715",
      "aliases": [
        "BIT-envoy-gateway-2026-53715",
        "CVE-2026-53715",
        "GHSA-8fv2-88gg-hm7q",
        "GO-2026-6005"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/envoyproxy/gateway",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "062b176235b72d339fac340d23dd37679b36dca6"
                },
                {
                  "introduced": "2de2611fdbbca83d4a1ede99417c90fcdead24d9"
                },
                {
                  "fixed": "097ab899b9d041452d02f15d738514eda10ea21b"
                },
                {
                  "fixed": "5a78db82b7cf4fc5bebbeda2c50952892038a464"
                },
                {
                  "fixed": "96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
                },
                {
                  "fixed": "b4737180c7e597490c6363075c565fa8cf24eead"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.7.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.8.0-rc.0"
                      },
                      {
                        "fixed": "1.8.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5a78db82b7cf4fc5bebbeda2c50952892038a464"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "96e2b750868a459ace4b8b68e6a6e4fb0152b9b7"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "b4737180c7e597490c6363075c565fa8cf24eead"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "062b176235b72d339fac340d23dd37679b36dca6"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.7.4"
                  },
                  {
                    "range": [
                      {
                        "fixed": "097ab899b9d041452d02f15d738514eda10ea21b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.8.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.8.0",
            "v1.7.3",
            "v1.8.0-rc.1",
            "v1.9.0-rc.0",
            "v1.7.2",
            "v1.7.1",
            "v1.8.0-rc.0",
            "v1.7.0",
            "v1.7.0-rc.2",
            "v1.7.0-rc.1",
            "v1.7.0-rc.0",
            "v1.6.0-rc.0",
            "latest",
            "v0.5.0-rc.1",
            "v0.2.0",
            "v0.2.0-rc2",
            "v0.2.0-rc1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53715.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:39.647583445Z",
      "provider": "osv",
      "references": [
        "https://github.com/envoyproxy/gateway/releases/tag/v1.7.4",
        "https://github.com/envoyproxy/gateway/releases/tag/v1.8.1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53715.json",
        "https://github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-53715",
        "https://github.com/envoyproxy/gateway/commit/5a78db82b7cf4fc5bebbeda2c50952892038a464",
        "https://github.com/envoyproxy/gateway/commit/96e2b750868a459ace4b8b68e6a6e4fb0152b9b7",
        "https://github.com/envoyproxy/gateway/commit/b4737180c7e597490c6363075c565fa8cf24eead",
        "https://github.com/envoyproxy/gateway/pull/9171",
        "https://github.com/envoyproxy/gateway/pull/9172",
        "https://github.com/envoyproxy/gateway/pull/9173"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-362"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53715.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-53715",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 507149,
  "published_at": "2026-09-14T20:14:34.223+00:00"
}