CVE-2026-47692
published 2026-06-26CVE-2026-47692: Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2…
PriorityP420medium4.3CVSS 3.1
AVAACLPRNUINSUCNILAN
EPSS
0.22%
11.6th percentile
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.34.0 < 1.35.13 | 1.35.13 |
| envoyproxy | envoy | >= 1.36.0 < 1.36.9 | 1.36.9 |
| envoyproxy | envoy | >= 1.37.0 < 1.37.5 | 1.37.5 |
| envoyproxy | envoy | >= 1.38.0 < 1.38.3 | 1.38.3 |
| openshift-service-mesh | istio-proxyv2-rhel9 | — | — |
| openshift-service-mesh | proxyv2-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
envoy: Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
vendor_redhat·2026-06-26·CVSS 4.3
CVE-2026-47692 [MEDIUM] CWE-130 envoy: Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
envoy: Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
A flaw was found in Envoy. The PROXY Protocol v2 header generator can emit data beyond the maximum allowed length, leading to a mismatch between the actual bytes sent and the length specified in the header. An at
VulDB
envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 PROXY Protocol length length parameter (GHSA-wh36-hm39-mm3r)
vuldb·2026-06-26·CVSS 4.8
CVE-2026-47692 [MEDIUM] envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 PROXY Protocol length length parameter (GHSA-wh36-hm39-mm3r)
A vulnerability described as problematic has been identified in envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2. Affected by this vulnerability is an unknown functionality of the component PROXY Protocol. Such manipulation of the argument length leads to improper handling of length parameter inconsistency.
This vulnerability is referenced as CVE-2026-47692. The attack needs to be initiated within the local network. No exploit is available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
2026-06-26
Published