This vulnerability arises from a logic error in Envoy's Zstd decompressor implementation, where a ratio check is performed at the wrong loop depth. When a specially crafted, highly compressed ZSTD payload is decompressed, the algorithm may allocate an enormous amount of memory, far exceeding anticipated limits. The result is a memory exhaustion scenario that can trigger an Out‑of‑Memory kill of the Envoy process, effectively taking the proxy offline and causing a denial of service for all traffic it routes.

The affected product is the Envoy open‑source edge and service proxy by envoyproxy. Versions from 1.23.0 through 1.38.1 are vulnerable unless the patch versions 1.35.11, 1.36.7, 1.37.3, or 1.38.1 are applied. All other releases are not affected.

A CVSS score of 7.5 places the flaw in the high‑severity range, indicating significant impact on availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is remote; an attacker who can send data to an Envoy instance with ZSTD decompression enabled can craft a malicious payload that triggers the memory blow‑up. Successful exploitation requires only network access to the proxy and can be performed without authentication, making it a serious threat to exposed Envoy deployments.