CVE-2026-53715: 
Wolfi vulnerability analysis and mitigation

CVE-2026-53715 is a race condition vulnerability in Envoy Gateway (the open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway) that can cause a cross-tenant control-plane denial of service. The flaw exists in HTTPServer.ServeHTTP within internal/wasm/httpserver.go, which reads the mappingPath2Cache map without synchronization while HTTPServer.Get writes to it during EnvoyExtensionPolicy translation. It affects all versions prior to 1.7.4 and versions 1.8.0-rc.0 through 1.8.0 (before 1.8.1). The advisory was first published on June 5, 2026, with CVE assignment and NVD publication following on September 14, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). Specifically, httpserver.go line 153 reads s.mappingPath2Cache — a plain Go map — without holding any lock, while lines 201 and 209 write to the same map under s.Lock() during EnvoyExtensionPolicy translation. Because Go's runtime detects concurrent map read/write and calls runtime.throw, and because net/http's per-connection recover() cannot intercept a throw, the entire controller process terminates. Exploitation requires four simultaneous preconditions: pod-network reachability to the unauthenticated port 18002, tenant permission to create EnvoyExtensionPolicy resources, an attacker pod flooding GET requests to port 18002, and a timing overlap between a per-request reader goroutine and a writer goroutine — making the trigger probabilistic but attacker-controllable (GitHub Advisory).

Successful exploitation causes the Envoy Gateway controller process to crash via an unrecoverable Go runtime panic, resulting in a control-plane denial of service that affects all tenants sharing the same controller pod until Kubernetes automatically restarts it. There is no confidentiality or integrity impact — the vulnerability is availability-only. Because the controller is a shared, multi-tenant component, a single low-privileged tenant can disrupt gateway management for all other tenants during the outage window (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable due to the high attack complexity required to win the race condition. The EPSS score is approximately 0.357%, indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Establish pod-network access: Deploy or compromise a pod within the Kubernetes cluster that has network reachability to the Envoy Gateway controller pod on port 18002 (the unauthenticated Wasm HTTP server).
2. Obtain tenant permissions: Acquire Kubernetes RBAC permissions sufficient to create or update EnvoyExtensionPolicy resources in at least one namespace.
3. Churn EnvoyExtensionPolicy resources: Rapidly and repeatedly create/update EnvoyExtensionPolicy objects referencing distinct Wasm URLs (e.g., using kubectl apply in a tight loop or a scripted client), causing the controller's HTTPServer.Get to continuously write new entries to mappingPath2Cache under the write lock.
4. Flood GET requests to port 18002: Simultaneously send a high volume of HTTP GET requests from the attacker pod to http://<controller-pod-ip>:18002/, spawning many concurrent reader goroutines that access mappingPath2Cache without a lock.
5. Trigger the race condition: Continue both operations until a reader goroutine at line 153 of httpserver.go overlaps with a writer goroutine at lines 201/209, causing Go's runtime to detect the concurrent map access and invoke runtime.throw.
6. Controller crash and DoS: The unrecoverable panic terminates the controller process, disrupting control-plane operations for all tenants until Kubernetes restarts the pod (GitHub Advisory).

• Logs: Envoy Gateway controller pod logs showing a Go runtime panic message such as fatal error: concurrent map read and map write or runtime.throw stack traces originating from internal/wasm/httpserver.go.
• Logs: Kubernetes event logs recording repeated unexpected pod restarts (CrashLoopBackOff or OOMKilled-equivalent restart events) for the Envoy Gateway controller pod in a short time window.
• Network: Unusually high volume of HTTP GET requests to port 18002 on the controller pod from a single source pod IP, visible in network flow logs or pod-level network monitoring.
• Kubernetes API: Rapid, high-frequency creation or update of EnvoyExtensionPolicy resources with varying Wasm URLs from a single service account, observable in Kubernetes audit logs (audit.log) with repeated create/update verbs on envoyextensionpolicies resources.
• Process: Sudden termination and restart of the envoy-gateway controller process, detectable via process monitoring or container restart count metrics (GitHub Advisory).

Upgrade Envoy Gateway to version 1.7.4 (for the 1.7.x branch) or 1.8.1 (for the 1.8.x branch), which add proper synchronization around reads of mappingPath2Cache in httpserver.go. The fixes were merged via pull requests #9171 (release-1.7), #9172 (release-1.8), and #9173 (main) on June 5, 2026. As a network-level workaround prior to patching, restrict pod-network access to controller port 18002 using Kubernetes NetworkPolicy to limit which pods can reach the Wasm HTTP server, and apply least-privilege RBAC to prevent untrusted tenants from creating EnvoyExtensionPolicy resources (GitHub Advisory, PR #9171, PR #9172).