CVE-2026-47774Disclosure(envoyproxy / envoy)

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch envoyproxy envoy systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.

envoyproxy CVEs Back to dashboard

4.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://bugzilla.redhat.com/show_bug.cgi?id=2487465

Vendor / third-party advisories

Weakness type (CWE)

CWE-405CWE-770CWE-409

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

envoy
openshift_service_mesh

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 5d ago at 2 mentions (2026-06-07); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

envoyproxy redhat

Products

envoyopenshift_service_mesh

1 version affected across 2 products

Deep dive

Activity timeline8 mentions / 6d

Signal classification4 categories

Disclosure

337.5%

Patch

337.5%

Active Exploitation

112.5%

General

112.5%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	2	Disclosure1Patch1
2026-06-09	1	Patch1
2026-06-15	1	Active Exploitation1
2026-06-17	2	Disclosure1Patch1
2026-06-18	1	Disclosure1
2026-07-06	1	General1

Full discourse8 posts

stuons@stuons137d
Patch
#RHEL でも対応中か RHSB-2026-007 HTTP/2 HPACK Denial of Service - httpd, nginx, Envoy (CVE-2026-49975, CVE-2026-47774) - "HTTP/2 Bomb" https://access.redhat.com/security/vulnerabilities/RHSB-2026-007
Post summary
The post references a Red Hat advisory for an HTTP/2 HPACK Denial‑of‑Service flaw affecting httpd, nginx, and Envoy (CVE‑2026‑49975, CVE‑2026‑47774), indicating a vendor patch is available, but no PoC or exploitation details are mentioned.
10000183
427 followersView on X
MalwareObserver@MalwareObserver107d
General
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-47774](https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8) Env... https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8 #PatchManagement #Vulnerability #CVE
Post summary
The tweet briefly alerts about CVE-2026-47774 and provides a link to the official advisory, but it lacks deeper technical detail or actionable information.
0000043
8 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds126d
Disclosure
CVE-2026-47774 HTTP/2 Memory Exhaustion Denial of Service in Envoy Prior to 1.35.11 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47774
Post summary
The text announces a memory exhaustion denial‑of‑service vulnerability (CVE-2026-47774) in Envoy servers before version 1.35.11, triggered through HTTP/2.
0000051
4.1K followersView on X
Infoflowcloud@infoflowcloud126d
Patch
🚨*CVE* CVE-2026-47774 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy… https://www.cve.org/CVERecord?id=CVE-2026-47774 ----- Traducción: CVE-2026-47774 Env… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-47774 affecting Envoy, identifies vulnerable versions and links to the CVE record, but offers no PoC, exploit, or detailed vulnerability info.
0000041
82 followersView on X
CVE@CVEnew126d
Disclosure
CVE-2026-47774 Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy… https://www.cve.org/CVERecord?id=CVE-2026-47774
Post summary
The message announces a new CVE (CVE-2026-47774) affecting Envoy, noting vulnerable versions but providing no PoC, exploit code, patched fixes, or detailed technical information.
00000158
57.6K followersView on X
VulDB 🛡@vuldb128d
Active Exploitation
It is possible to see elevated activities targeting Envoy (CVE-2026-47774) https://vuldb.com/vuln/370872/cti
Post summary
The thread notes increased activity targeting Envoy for CVE-2026-47774, implying possible exploitation in the wild, but provides no PoC, patch, or technical detail.
0000052
2.2K followersView on X
Mario Fahlandt 🦊@mfahlandt135d
Patch
🛡️ Cloud Native Security Updates (Week 24, 2026). Envoy v1.38.1+ mitigates CVE-2026-47774. containerd v2.1.8 fixes CVE-2026-46680. Longhorn v1.12.0: V2 Data Engine GA. https://lwcn.dev/newsletter/2026-week-24/
Post summary
The notice informs that recent releases of Envoy and containerd include mitigations for CVE-2026-47774 and CVE-2026-46680, respectively, while also highlighting a new Longhorn release.
0000060
501 followersView on X
S.Komichevsen Matsuk@w4yh137d
Disclosure
SBが出たってことはアップデートはまだ時間かかりそうですかね... // RHSB-2026-007 HTTP/2 HPACK Denial of Service - httpd, nginx, Envoy (CVE-2026-49975, CVE-2026-47774) - "HTTP/2 Bomb" | Red Hat Customer Portal https://access.redhat.com/security/vulnerabilities/RHSB-2026-007
Post summary
The post announces the RHSB-2026-007 security bulletin for two HTTP/2 HPACK DoS CVEs, suggesting updates are not yet available, but does not provide PoC, exploit, or patch details.
00000135
320 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	envoyproxy	envoy	-	-	-
App	envoyproxy	envoy	1.38.0	-	-
App	redhat	openshift_service_mesh	-	-	-

Explore more

Back to dashboard envoyproxy CVEs redhat CVEs envoy vulnerabilities

What researchers are saying

CVE-2026-47774

stuons[verified]@stuonsPatch

The post references a Red Hat advisory for an HTTP/2 HPACK Denial‑of‑Service flaw affecting httpd, nginx, and Envoy (CVE‑2026‑49975, CVE‑2026‑47774), indicating a vendor patch is available, but no PoC or exploitation details are mentioned.

MalwareObserver[verified]@MalwareObserverGeneral

The tweet briefly alerts about CVE-2026-47774 and provides a link to the official advisory, but it lacks deeper technical detail or actionable information.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a memory exhaustion denial‑of‑service vulnerability (CVE-2026-47774) in Envoy servers before version 1.35.11, triggered through HTTP/2.

Infoflowcloud@infoflowcloudPatch

The tweet announces CVE-2026-47774 affecting Envoy, identifies vulnerable versions and links to the CVE record, but offers no PoC, exploit, or detailed vulnerability info.

CVE@CVEnewDisclosure

The message announces a new CVE (CVE-2026-47774) affecting Envoy, noting vulnerable versions but providing no PoC, exploit code, patched fixes, or detailed technical information.

VulDB 🛡@vuldbActive Exploitation

The thread notes increased activity targeting Envoy for CVE-2026-47774, implying possible exploitation in the wild, but provides no PoC, patch, or technical detail.

Mario Fahlandt 🦊@mfahlandtPatch

The notice informs that recent releases of Envoy and containerd include mitigations for CVE-2026-47774 and CVE-2026-46680, respectively, while also highlighting a new Longhorn release.

S.Komichevsen Matsuk@w4yhDisclosure

The post announces the RHSB-2026-007 security bulletin for two HTTP/2 HPACK DoS CVEs, suggesting updates are not yet available, but does not provide PoC, exploit, or patch details.