envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2 PROXY Protocol length length parameter

Summaryinfo

A vulnerability classified as problematic has been found in envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2. Affected by this issue is some unknown functionality of the component PROXY Protocol. Performing a manipulation of the argument length results in length parameter. This vulnerability is identified as CVE-2026-47692. The attack can only be performed from the local network. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in envoyproxy envoy up to 1.35.12/1.36.8/1.37.4/1.38.2. This affects some unknown processing of the component PROXY Protocol. The manipulation of the argument length with an unknown input leads to a length parameter vulnerability. CWE is classifying the issue as CWE-130. The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. This is going to have an impact on integrity, and availability. The summary by CVE is:

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-47692 since 05/19/2026. The exploitability is told to be easy. Access to the local network is required for this attack to succeed. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.35.13, 1.36.9, 1.37.5 or 1.38.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• envoyproxy

Name

• envoy

Version

• 1.35.0
• 1.35.1
• 1.35.2
• 1.35.3
• 1.35.4
• 1.35.5
• 1.35.6
• 1.35.7
• 1.35.8
• 1.35.9
• 1.35.10
• 1.35.11
• 1.35.12
• 1.36.0
• 1.36.1
• 1.36.2
• 1.36.3
• 1.36.4
• 1.36.5
• 1.36.6
• 1.36.7
• 1.36.8
• 1.37.0
• 1.37.1
• 1.37.2
• 1.37.3
• 1.37.4
• 1.38.0
• 1.38.1
• 1.38.2

License

• free

Website

• Product: https://github.com/envoyproxy/envoy/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion