| id: GO-2026-6008 | |
| modules: | |
| - module: github.com/envoyproxy/gateway | |
| versions: | |
| - fixed: 1.7.4 | |
| - introduced: 1.8.0-rc.0 | |
| - fixed: 1.8.1 | |
| vulnerable_at: 1.8.0 | |
| summary: |- | |
| Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from | |
| untrusted tar header in github.com/envoyproxy/gateway | |
| cves: | |
| - CVE-2026-53717 | |
| ghsas: | |
| - GHSA-h7pq-86h8-rp5x | |
| references: | |
| - advisory: https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x | |
| source: | |
| id: GHSA-h7pq-86h8-rp5x | |
| created: 2026-07-17T13:12:58.694810659-04:00 | |
| review_status: UNREVIEWED |