Intel

AIKIDO-2026-10199

github.com/envoyproxy/gateway is vulnerable to Memory Leak

Memory Leak Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Feb 21, 2026

30

Low Risk

This Affects:

GOgithub.com/envoyproxy/gateway
0.0.1 - 1.6.4
Fixed in 1.7.0
Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to a resource exhaustion issue due to a memory leak in status map handling. Certain watchable.Map instances are not properly closed during provider shutdown, leaving associated goroutines running and blocked on channels. Repeated use may cause unbounded goroutine growth, leading to increased memory usage and potential denial of service.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/envoyproxy/gateway is vulnerable to Memory Leak in versions 0.0.1 - 1.6.4.

How to fix this

Upgrade the github.com/envoyproxy/gateway library to the patch version.