Package
tigera-operator-1.38
Component
github.com/envoyproxy/gateway
Latest update
6.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
tigera-operator depends on github.com/envoyproxy/gateway v1.5.9 but imports only the CRD API type definitions (api/v1alpha1) used to register and render Gateway API custom resources. CVE-2026-53716 affects Envoy Gateway's Wasm HTTP fetcher, which decompresses gzip responses without an output-size limit, which is not imported, compiled, or linked into the operator binary. Verified via the compile-time import graph, which resolves api/v1alpha1 as the only envoyproxy/gateway package in the build, and via the built binary's symbol table, which contains 1059 api/v1alpha1 symbols and zero symbols from the affected code. The operator does not run the Envoy Gateway control plane, so the vulnerable code is not present. Upstream fixed the flaw at the module level in Envoy Gateway 1.7.4/1.8.1; the fix is not applicable here because the affected code is absent. Refs: NVD CVE-2026-53716, GHSA-cxpq-8v7q-cg56.
Status