CVE-2026-47692 | Envoy is an open source edge and service proxy designed for … | CVSS 4.8 MEDIUM

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Metadata

CVE ID: CVE-2026-47692
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-19 21:18 UTC
Published: 2026-06-26 17:59 UTC
Last updated: 2026-06-26 19:07 UTC
Primary CWE: CWE-130
CWE-130: Improper Handling of Length Parameter Inconsistency
Vendor / Product: envoyproxy / envoy
Sources: cve.org · NVD

Severity & Metrics

4.8 MEDIUM CVSS 3.1

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
envoyproxy	envoy	—	>= 1.38.0, < 1.38.3, >= 1.37.0, < 1.37.5, >= 1.36.0, < 1.36.9, >= 1.34.0, < 1.35.13

Weakness (CWE)

CWE	Source	Description
CWE-130	cna	CWE-130: Improper Handling of Length Parameter Inconsistency

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.8	MEDIUM	3.1	cna	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

References (1)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r