Vulnerability · Published Jun 26, 2026 · Assigned by GitHub_M

CVE-2026-47692Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

Medium 4.8

In plain English

A medium-severity security flaw in envoy from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.2%top 87.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.38.0, < 1.38.3>= 1.37.0, < 1.37.5>= 1.36.0, < 1.36.9>= 1.34.0, < 1.35.13

Weakness: CWE-130 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r x_refsource_CONFIRM