Description
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | < 1.22.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | servicemesh +5 | 2.1.3-1.el8 | RHSA-2022:5004 |
| Red Hat Service Mesh 2 | servicemesh-operator | 2.1.3-2.el8 | RHSA-2022:5004 |
| Red Hat Service Mesh 2 | servicemesh-prometheus | 2.23.0-7.el8 | RHSA-2022:5004 |
| Red Hat Service Mesh 2 | servicemesh-proxy | 2.0.10-1.el8 | RHSA-2022:5004, RHSA-2022:5003 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | cri-o | 1.23.3-1.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | cri-tools | 1.23.0-1.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | etcd | 3.5.1-2.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | istio +1 | 1.13.5-1.el8 | ELSA-2022-9588, ELSA-2022-9586 |
| Oracle Linux 8 | kata | 1.12.1-5.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | kubeadm +2 | 1.23.7-1.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | olcne-metallb-chart +1 | 1.5.4-3.el8 | ELSA-2022-9588 |
| Oracle Linux 8 | olcnectl +10 | 1.4.6-2.el8 | ELSA-2022-9588, ELSA-2022-9586 |
| Oracle Linux 7 | cri-o | 1.23.3-1.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | cri-tools | 1.23.0-1.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | etcd | 3.5.1-2.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | istio +1 | 1.13.5-1.el7 | ELSA-2022-9589, ELSA-2022-9587 |
| Oracle Linux 7 | kata | 1.12.1-5.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | kubeadm +2 | 1.23.7-1.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | olcne-metallb-chart +1 | 1.5.4-3.el7 | ELSA-2022-9589 |
| Oracle Linux 7 | olcnectl +10 | 1.4.6-2.el7 | ELSA-2022-9589, ELSA-2022-9587 |
Advisories 7
- WID-SEC-2022-0288 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- RHSA-2022:5004 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2022:5003 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.10 security update Red Hat Security Advisories (RHSA) · Mar 18, 2026
- ELSA-2022-9588 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 12, 2022
- ELSA-2022-9589 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 12, 2022
- ELSA-2022-9586 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 11, 2022
- ELSA-2022-9587 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 11, 2022