CVE-2026-47692

Published: Jun 26, 2026Modified: Jun 27, 2026

4.3

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Affected (4)

Products: Envoyproxy: Envoy

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	From 1.34.0 to 1.35.13
Envoyproxy Envoy	From 1.36.0 to 1.36.9
Envoyproxy Envoy	From 1.37.0 to 1.37.5
Envoyproxy Envoy	From 1.38.0 to 1.38.3

Related CWEs

Improper Handling of Length Parameter Inconsistency

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

References (1)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.