Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
envoyproxy envoy — Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U N N H 7.5 .0097 59.0 —
AFFECTED
Product Versions Fixed
envoy < 1.35.11 – —
TIMELINE
May 19 Reserved by GitHub_M
Jun 17 EXPLOIT PUBLISHED — CVE-2026-47774 (envoyproxy envoy). Public exploit reference added.
Jun 17 Published (CNA: GitHub_M)
Jul 20 EXPLOIT PUBLISHED — CVE-2026-47774 (envoyproxy envoy). Public exploit reference added.
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| May 19, 2026 | Reserved | Reserved by GitHub_M |
| June 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-47774 (envoyproxy envoy). Public exploit reference added. |
| June 17, 2026 | Published | Published (CNA: GitHub_M) |
| July 20, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-47774 (envoyproxy envoy). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| envoyproxy | envoy | — | < 1.35.11 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-47774 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.