Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-47774 is a high-severity Amplification (CWE-405) vulnerability in Redhat Openshift Service Mesh. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-37765
Vulnerability Data
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger excessive memory consumption, potentially…
more
resulting in OOM termination of the Envoy process and denial of service. The issue arises from the combination of two behaviors. First, cookie header bytes are not fully accounted for during request header size validation in Envoy. Second, HPACK header block limits in oghttp2/quiche are enforced on encoded bytes without a corresponding limit on total decoded header size. Together, these behaviors allow a malicious client to cause large decoded header allocations while bypassing the intended request header size protections. Versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 contain a fix. No complete workaround is known short of applying a fix. Possible temporary mitigations include disabling downstream HTTP/2 where operationally feasible; enforcing stricter request header and cookie limits before traffic reaches Envoy; and monitoring Envoy memory usage for abnormal growth under HTTP/2 traffic.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of public-facing Envoy proxy for resource exhaustion/DoS via crafted HTTP/2 requests directly maps to T1190 and T1499.004.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of HTTP/2 header and cookie sizes to block the oversized decoded allocations that trigger OOM.
Limits or drops resource-exhausting HTTP/2 streams before they can consume unbounded memory in the proxy.
Monitors Envoy memory usage and abnormal header-processing behavior to identify exploitation in progress.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Resilience mechanisms such as rate limiting and load balancing directly constrain asymmetric resource use.
Capacity planning and monitoring maintain availability headroom against amplification attacks.
Secure-development practices include input-validation and resource-limit checks that prevent improper handling of compressed data.
Network monitoring detects amplification traffic patterns but does not itself limit asymmetric consumption.
Runtime resource monitoring can surface excessive consumption yet does not enforce authorization or work proofs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Baseline comparison of CPU, memory and bandwidth usage helps surface uncontrolled resource allocations before they cause service degradation.
Security testing can uncover decompression-bomb vulnerabilities before release.
Capacity projections and elasticity measures ensure that allocation requests are bounded and can be throttled, reducing the window in which an attacker can force unbounded resource reservations.
Defining retention periods and deletion schedules for backup copies prevents indefinite accumulation of data on storage media without corresponding resource-management controls.
Architectural redundancy and automatic failover limit the impact of an attacker who forces excessive allocations, because spare capacity can absorb the load until the primary instance recovers.
Secure development lifecycle includes input validation and resource-limit checks that mitigate data-amplification attacks.