What is the CVSS score of CVE-2026-47692?

CVE-2026-47692 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47692?

Yes, a patch is available for CVE-2026-47692. Update the affected software to the latest version immediately.

Envoy Proxy CVE-2026-47692

EUVD-2026-39827 MEDIUM

Improper Handling of Length Parameter Inconsistency (CWE-130)

2026-06-26 GitHub_M

Information Disclosure Red Hat Envoy Suse Envoyproxy

4.3

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.8 MEDIUM

Adjacent vector and PR:H reflect operator-level config access required; S:C captures smuggled-byte impact on upstream services outside Envoy's trust boundary.

3.1 AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

SUSE

MEDIUM

qualitative

Red Hat

4.8 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 27, 2026 - 20:22 NVD

4.8 (MEDIUM) 4.3 (MEDIUM)

Patch available

Jun 26, 2026 - 19:02 EUVD

Analysis Generated

Jun 26, 2026 - 18:37 vuln.today

DescriptionNVD

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

AnalysisAI

PROXY Protocol v2 TLV overflow in Envoy Proxy versions 1.34.0 through the pre-fix series allows an operator-level attacker on an adjacent network to smuggle extraneous bytes into upstream requests. Envoy's header generator writes TLV content exceeding the protocol-mandated 65535-byte maximum without adjusting the length field, creating a header where declared length and actual byte count diverge - a textbook CWE-130 length-parameter inconsistency. No public exploit code has been identified and this vulnerability does not appear in the CISA KEV catalog; risk is constrained by the high-privilege and adjacent-network prerequisites reflected in the CVSS 4.8 medium score.

Technical ContextAI

PROXY Protocol v2 is a binary wire protocol used by load balancers and proxies (including Envoy) to forward client connection metadata to upstream services using Type-Length-Value (TLV) extensions. The TLV aggregate is bounded by a 16-bit length field capped at 65535 bytes. CWE-130 (Improper Handling of Length Parameter Inconsistency) describes exactly this class of defect: the implementation writes more bytes than the length field declares, so downstream parsers reading exactly 'length' bytes leave undeclared trailing bytes in the stream, which then merge into the next protocol unit as smuggled data. The affected CPE is cpe:2.3:a:envoyproxy:envoy covering the 1.34.0 release line up to the patched versions. Envoy is the data-plane proxy underpinning Istio and many AWS/GCP managed service meshes, so the TLV generator is exercised whenever PROXY Protocol v2 upstream header injection is configured.

RemediationAI

Upgrade Envoy to one of the patched releases: 1.35.13, 1.36.9, 1.37.5, or 1.38.3 as appropriate for the deployed branch. These versions are confirmed fixed per the vendor security advisory at https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r. For environments unable to upgrade immediately, a targeted workaround is to disable or remove PROXY Protocol v2 upstream header injection from the Envoy cluster configuration (set 'use_proxy_proto: false' or omit the PROXY Protocol transport socket from upstream cluster definitions); this eliminates the vulnerable code path entirely but removes PROXY Protocol client-IP forwarding to upstream services, which may break source-IP-dependent features. Restricting Envoy configuration-plane access to a minimal set of trusted operators reduces the exploitable surface given the PR:H requirement.