CVE-2026-47692

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy::::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Envoy es un proxy de borde y de servicio de código abierto diseñado para aplicaciones nativas de la nube. Desde la versión 1.34.0 hasta las versiones 1.35.13, 1.36.9, 1.37.5 y 1.38.3, el generador de encabezados del PROXY Protocolo v2 emite TLVs que exceden la longitud máxima de 65535 bytes, lo que causa una discrepancia entre los bytes escritos y el campo de longitud en el encabezado. Esto puede resultar en bytes contrabandeados en la solicitud ascendente. Esta vulnerabilidad está corregida en las versiones 1.35.13, 1.36.9, 1.37.5 y 1.38.3.

Information

Published : 2026-06-26 18:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-47692

Mitre link : CVE-2026-47692

CVE.ORG link : CVE-2026-47692

JSON object : View

Products Affected

envoyproxy

envoy

CWE

CWE-130

Improper Handling of Length Parameter Inconsistency

{"id": "CVE-2026-47692", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47692", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T19:07:31.350962Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"status": "affected", "version": ">= 1.38.0, < 1.38.3"}, {"status": "affected", "version": ">= 1.37.0, < 1.37.5"}, {"status": "affected", "version": ">= 1.36.0, < 1.36.9"}, {"status": "affected", "version": ">= 1.34.0, < 1.35.13"}]}]}], "published": "2026-06-26T18:16:59.220", "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-130"}]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3."}, {"lang": "es", "value": "Envoy es un proxy de borde y de servicio de c\u00f3digo abierto dise\u00f1ado para aplicaciones nativas de la nube. Desde la versi\u00f3n 1.34.0 hasta las versiones 1.35.13, 1.36.9, 1.37.5 y 1.38.3, el generador de encabezados del PROXY Protocolo v2 emite TLVs que exceden la longitud m\u00e1xima de 65535 bytes, lo que causa una discrepancia entre los bytes escritos y el campo de longitud en el encabezado. Esto puede resultar en bytes contrabandeados en la solicitud ascendente. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.35.13, 1.36.9, 1.37.5 y 1.38.3."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCF9A646-8301-48C6-9A3D-F53AFAE75C39", "versionEndExcluding": "1.35.13", "versionStartIncluding": "1.34.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1146A14-3C49-48C3-BC2A-1BBB202EBD84", "versionEndExcluding": "1.36.9", "versionStartIncluding": "1.36.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2057BF79-00D1-4154-9DC0-3F278C72F4E1", "versionEndExcluding": "1.37.5", "versionStartIncluding": "1.37.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A218AD4-BF4B-46EA-96D7-3B25B7E71AC8", "versionEndExcluding": "1.38.3", "versionStartIncluding": "1.38.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}