Update module github.com/envoyproxy/gateway to v1.7.4 [SECURITY] (#53764)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [github.com/envoyproxy/gateway](https://redirect.github.com/envoyproxy/gateway) | `v1.7.1` → `v1.7.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fenvoyproxy%2fgateway/v1.7.4?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fenvoyproxy%2fgateway/v1.7.4?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fenvoyproxy%2fgateway/v1.7.1/v1.7.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fenvoyproxy%2fgateway/v1.7.1/v1.7.4?slim=true) |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/33469) for more information.

---

### Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
[CVE-2026-53718](https://nvd.nist.gov/vuln/detail/CVE-2026-53718) / [GHSA-fcrp-7gc2-93g7](https://redirect.github.com/advisories/GHSA-fcrp-7gc2-93g7)

<details>
<summary>More information</summary>

#### Details
##### Impact
Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.

##### Patches
[1.7.4](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.7.4)
[1.8.1](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.8.1)

#### Severity
- CVSS Score: 6.4 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-fcrp-7gc2-93g7)
- [https://github.com/advisories/GHSA-fcrp-7gc2-93g7](https://redirect.github.com/advisories/GHSA-fcrp-7gc2-93g7)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-fcrp-7gc2-93g7) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
[CVE-2026-53716](https://nvd.nist.gov/vuln/detail/CVE-2026-53716) / [GHSA-cxpq-8v7q-cg56](https://redirect.github.com/advisories/GHSA-cxpq-8v7q-cg56)

<details>
<summary>More information</summary>

#### Details
Vulnerability report without repro case. Repro case may be added later after harness is complete.

**Preconditions (4):**
- Tenant can create EnvoyExtensionPolicy (baseline)
- Attacker hosts a gzip-bomb at a reachable URL
- sha256 unset (optional field; check is post-decompression anyway)
- No operator Wasm-URL allowlist (none exists in code)

**Description**

getFileFromGZ calls io.ReadAll on a raw gzip.Reader (httpfetcher.go:216) with no output bound, while the compressed input is capped at 256 MiB (httpfetcher.go:139). The bytes originate from a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url (envoyextensionpolicy.go:1077 → cache.go:248 → httpfetcher.go:147 → :233), so an untrusted tenant can point at a ~10 MiB gzip-of-zeros and force ~10 GiB allocation in the shared controller process. All candidate guards execute either before the body is buffered or after decompression. OOM-kills, restarts, re-reconciles same CR, crash-loops — persistent cross-tenant control-plane outage with PR:L/AC:L and scope change → HIGH despite availability-only.

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-cxpq-8v7q-cg56)
- [https://github.com/advisories/GHSA-cxpq-8v7q-cg56](https://redirect.github.com/advisories/GHSA-cxpq-8v7q-cg56)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-cxpq-8v7q-cg56) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
[CVE-2026-53719](https://nvd.nist.gov/vuln/detail/CVE-2026-53719) / [GHSA-m2v6-2jmh-4c68](https://redirect.github.com/advisories/GHSA-m2v6-2jmh-4c68)

<details>
<summary>More information</summary>

#### Details
Vulnerability report without repro case. Repro case may be added later after harness is complete.

**Preconditions (4):**
- Tenant has SecurityPolicy + TCPRoute RBAC (baseline)
- Tenant namespace permitted to attach TCPRoute to a Gateway listener
- spec.authorization omitted (the trigger)
- No admission webhook blocks the shape

**Description:**

A namespace-scoped tenant can deterministically panic the gatewayapi runner on every reconcile with a single CRD; the recover() in message/watchutil.go:53 keeps the process alive but unwinds the entire handle() callback in runner/runner.go:192, so xDS/Infra IR publishing stalls controller-wide until an admin deletes the object. Data plane keeps serving last-good config.

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-m2v6-2jmh-4c68)
- [https://github.com/advisories/GHSA-m2v6-2jmh-4c68](https://redirect.github.com/advisories/GHSA-m2v6-2jmh-4c68)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-m2v6-2jmh-4c68) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
[CVE-2026-53717](https://nvd.nist.gov/vuln/detail/CVE-2026-53717) / [GHSA-h7pq-86h8-rp5x](https://redirect.github.com/advisories/GHSA-h7pq-86h8-rp5x)

<details>
<summary>More information</summary>

#### Details
Vulnerability report without repro case. Repro case may be added later after harness is complete.

**Preconditions (4):**
- Tenant can create EnvoyExtensionPolicy (baseline)
- Controller has egress to attacker-controlled OCI registry
- No registry allowlist (none exists in code)
- Layer presents Docker/OCI media type

**Description**

At imagefetcher.go:287, make([]byte, h.Size) uses the attacker-controlled tar-header size; the LimitReader at :278 bounds bytes read from the stream but not the header-declared size returned by tr.Next() (a 512-byte header can claim a multi-TB entry via PAX/GNU encoding). Reached from untrusted tenant input via EnvoyExtensionPolicy spec.wasm[].code.image.url (envoyextensionpolicy.go:1157 → cache.go:262/299 → imagefetcher.go:218 → :287), and the allocation happens for every tar entry regardless of filename. The resulting Go runtime OOM throw is unrecoverable and, because the CRD persists, crash-loops the shared controller — single-request, non-volumetric, cluster-wide DoS.

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-h7pq-86h8-rp5x)
- [https://github.com/advisories/GHSA-h7pq-86h8-rp5x](https://redirect.github.com/advisories/GHSA-h7pq-86h8-rp5x)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-h7pq-86h8-rp5x) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
[CVE-2026-53715](https://nvd.nist.gov/vuln/detail/CVE-2026-53715) / [GHSA-8fv2-88gg-hm7q](https://redirect.github.com/advisories/GHSA-8fv2-88gg-hm7q)

<details>
<summary>More information</summary>

#### Details
Vulnerability report without repro case. Repro case may be added later after harness is complete.

**Preconditions (4):**
- Pod-network reachability to :18002 (no auth)
- Tenant can create EnvoyExtensionPolicy (baseline)
- Attacker pod floods GET while churning EnvoyExtensionPolicy with distinct Wasm URLs
- Read at :153 must overlap a write at :201/:209 (probabilistic, attacker controls both rates)

**Description:**

httpserver.go:153 reads s.mappingPath2Cache with no lock while httpserver.go:201/209 write it under s.Lock(); the struct uses a plain map. Writer is tenant-reachable via EnvoyExtensionPolicy translation, reader is pod-network-reachable on :18002 with per-request goroutines. Go's concurrent map read+write detection calls runtime.throw, which net/http's per-conn recover cannot catch, so the controller process exits — cross-tenant control-plane DoS. Capped at MEDIUM: DoS-only, k8s restarts pod, timing-dependent trigger.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-8fv2-88gg-hm7q)
- [https://github.com/advisories/GHSA-8fv2-88gg-hm7q](https://redirect.github.com/advisories/GHSA-8fv2-88gg-hm7q)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-8fv2-88gg-hm7q) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
[CVE-2026-53713](https://nvd.nist.gov/vuln/detail/CVE-2026-53713) / [GHSA-wcrf-9vrr-854f](https://redirect.github.com/advisories/GHSA-wcrf-9vrr-854f)

<details>
<summary>More information</summary>

#### Details
##### Impact

The `to_absolute_normalized_path` function (security.lua:28-43) does not collapse redundant path separators (// → /). On Linux, `//etc/passwd` is equivalent to `/etc/passwd` (POSIX path semantics), but `is_critical_path` fails to match the double-slash variant because `//etc/passwd` does not start with `/etc/`.

This allows Lua code submitted as an `EnvoyExtensionPolicy` to read arbitrary files from the gateway controller pod's filesystem during Strict validation (the default), including:

* `/etc/passwd`
* Kubernetes SA tokens via `//var/run/secrets/kubernetes.io/serviceaccount/token`
* TLS certificates via `//certs/...`
* Process environment via `//proc/self/environ`

These credentials can be used to read sensitive information from the K8s API Server or from the Gateway XDS server.

##### Patches

This has been patched in versions >= v1.7.4 and v1.8.1

  - Collapse redundant path separators (`//` to `/`) so double-slash variants like `//etc/passwd` and `//var/run/secrets/...` are matched by the critical-path check.
  - Rewrite the traversal check to reject any `.` or `..` segment in any position and across both separator styles (catches `/etc/./passwd`, `./etc/passwd`, `/etc/.`).

##### Workarounds
Please refer to the `Warning` section in [Lua docs](https://gateway.envoyproxy.io/v1.8/tasks/extensibility/lua/) for measures to reduce risk.

##### Credits

Envoy Gateway thanks @&#8203;dashingDragon and @&#8203;Donjon-Cerberus for reporting this issue.

#### Severity
- CVSS Score: 9.1 / 10 (Critical)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-wcrf-9vrr-854f)
- [https://github.com/advisories/GHSA-wcrf-9vrr-854f](https://redirect.github.com/advisories/GHSA-wcrf-9vrr-854f)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-wcrf-9vrr-854f) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode 
[CVE-2026-53714](https://nvd.nist.gov/vuln/detail/CVE-2026-53714) / [GHSA-22xc-xg2r-9j7v](https://redirect.github.com/advisories/GHSA-22xc-xg2r-9j7v)

<details>
<summary>More information</summary>

#### Details
##### Impact
When Envoy Gateway runs in GatewayNamespaceMode (`provider.kubernetes.deploy.type=GatewayNamespace`), the xDS gRPC server is configured with a `StreamInterceptor` for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary (Fetch) RPC methods for all registered discovery services. Since there is no unary interceptor, these Fetch endpoints are completely unauthenticated. 

Additionally, the JWT authentication interceptor in GatewayNamespaceMode only validates tokens when the received gRPC message is of type `discoveryv3.DeltaDiscoveryRequest` . If the message is a `discoveryv3.DiscoveryRequest` — used by the State-of-the-World (SotW) xDS protocol — the type assertion fails, the validation block is skipped entirely, and RecvMsg returns nil (success) without any authentication.

Any pod in the cluster that can reach the xDS server (port 18000) can use the SotW protocol to bypass JWT authentication and access:

* TLS private keys via StreamSecrets (SDS)
* All xDS resources via StreamAggregatedResources (ADS)
* Backend endpoints via StreamClusters / StreamEndpoints (CDS/EDS)
* Routing rules via StreamRoutes / StreamListeners (RDS/LDS)

##### Credits

Envoy Gateway thanks @&#8203;dashingDragon and @&#8203;Donjon-Cerberus for reporting this issue.

#### Severity
- CVSS Score: 7.4 / 10 (High)
- Vector String: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`

#### References
- [https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v](https://redirect.github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v)
- [https://github.com/advisories/GHSA-22xc-xg2r-9j7v](https://redirect.github.com/advisories/GHSA-22xc-xg2r-9j7v)

This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-22xc-xg2r-9j7v) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>envoyproxy/gateway (github.com/envoyproxy/gateway)</summary>

### [`v1.7.4`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.7.4)

[Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.7.3...v1.7.4)

### Release Announcement

Check out the [v1.7.4 release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.7.4) to learn more about the release.

#### What's Changed

- \[release/v1.7] fix: add unary interceptor and fix fail-open auth in GatewayNamespaceMode ([#&#8203;8986](https://redirect.github.com/envoyproxy/gateway/issues/8986)) by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;9116](https://redirect.github.com/envoyproxy/gateway/pull/9116)
- \[release/v1.7] bump ratelimit to [`b8d893f`](https://redirect.github.com/envoyproxy/gateway/commit/b8d893f3) by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;9119](https://redirect.github.com/envoyproxy/gateway/pull/9119)
- \[release-1.7] chore: bump golang to 1.25.11 by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;9148](https://redirect.github.com/envoyproxy/gateway/pull/9148)
- \[release-1.7] cherry pick for v1.7.4 by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;9152](https://redirect.github.com/envoyproxy/gateway/pull/9152)
- \[release/v1.7] cherry-pick for v1.7.4 by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;9120](https://redirect.github.com/envoyproxy/gateway/pull/9120)
- \[release-1.7] bump envoy to 1.37.3 by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;9167](https://redirect.github.com/envoyproxy/gateway/pull/9167)
- \[release-1.7] fix github SA for June release by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;9171](https://redirect.github.com/envoyproxy/gateway/pull/9171)
- \[release-1.7] cherry pick release notes and bump version by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;9176](https://redirect.github.com/envoyproxy/gateway/pull/9176)

**Full Changelog**: <envoyproxy/gateway@v1.7.3...v1.7.4>

### [`v1.7.3`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.7.3)

[Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.7.2...v1.7.3)

### Release Announcement

Check out the [v1.7.3  release announcement](https://gateway.envoyproxy.io/news/releases/notes/v1.7.3/) to learn more about the release.

#### What's Changed

- \[release/v1.7] bump grpc and otel by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8846](https://redirect.github.com/envoyproxy/gateway/pull/8846)
- \[release-1.7] bump golang by [@&#8203;zirain](https://redirect.github.com/zirain) in [#&#8203;8944](https://redirect.github.com/envoyproxy/gateway/pull/8944)
- \[release/v1.7] Cherry-pick for v1.7.3 by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8869](https://redirect.github.com/envoyproxy/gateway/pull/8869)
- \[release/v1.7] update release notes by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8946](https://redirect.github.com/envoyproxy/gateway/pull/8946)

**Full Changelog**: <envoyproxy/gateway@v1.7.2...v1.7.3>

### [`v1.7.2`](https://redirect.github.com/envoyproxy/gateway/releases/tag/v1.7.2)

[Compare Source](https://redirect.github.com/envoyproxy/gateway/compare/v1.7.1...v1.7.2)

##### Release Announcement

Check out the \[v1.7.2  release announcement]
(<https://gateway.envoyproxy.io/news/releases/notes/v1.7.2>) to learn more about the release.

##### What's Changed

- \[release/v1.7] bump envoy to 1.37.2 and ratelimit to [`05c08d0`](https://redirect.github.com/envoyproxy/gateway/commit/05c08d03) by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8763](https://redirect.github.com/envoyproxy/gateway/pull/8763)
- \[release/v1.7] cherry-pick for v1.7.2 by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8768](https://redirect.github.com/envoyproxy/gateway/pull/8768)
- \[release/v1.7] bump go to 1.25.9 by [@&#8203;cnvergence](https://redirect.github.com/cnvergence) in [#&#8203;8776](https://redirect.github.com/envoyproxy/gateway/pull/8776)

**Full Changelog**: <envoyproxy/gateway@v1.7.1...v1.7.2>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Paris)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/DataDog/datadog-agent).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJjaGFuZ2Vsb2cvbm8tY2hhbmdlbG9nIiwiZGVwZW5kZW5jaWVzIiwiZGVwZW5kZW5jaWVzLWdvIiwicWEvbm8tY29kZS1jaGFuZ2UiXX0=-->


Co-authored-by: dd-octo-sts[bot] <200755185+dd-octo-sts[bot]@users.noreply.github.com>
Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>

Author: 3 people

go.mod

@@ -264,7 +264,7 @@ require (
 	github.com/elastic/go-freelru v0.16.0
 	github.com/elastic/go-libaudit/v2 v2.6.2
 	github.com/elastic/go-seccomp-bpf v1.6.0
-	github.com/envoyproxy/gateway v1.7.1
+	github.com/envoyproxy/gateway v1.7.4
 	github.com/evanphx/json-patch/v5 v5.9.11
 	github.com/fatih/color v1.19.0
 	github.com/fatih/structtag v1.2.0