EUVD-2026-39827Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Adjacent vector and PR:H reflect operator-level config access required; S:C captures smuggled-byte impact on upstream services outside Envoy's trust boundary.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
AnalysisAI
PROXY Protocol v2 TLV overflow in Envoy Proxy versions 1.34.0 through the pre-fix series allows an operator-level attacker on an adjacent network to smuggle extraneous bytes into upstream requests. Envoy's header generator writes TLV content exceeding the protocol-mandated 65535-byte maximum without adjusting the length field, creating a header where declared length and actual byte count diverge - a textbook CWE-130 length-parameter inconsistency. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the attacker must hold high-privilege access to Envoy's configuration layer - sufficient to define or modify upstream cluster settings that enable PROXY Protocol v2 header injection with TLV content - as confirmed by CVSS PR:H; and (2) the attacker must operate from an adjacent network position (AV:A), meaning the same network segment or a directly connected infrastructure layer such as a service mesh control plane. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L) yields a 4.8 Medium, which accurately reflects the constrained exploitation surface: the attacker must already hold high privileges over Envoy's configuration layer and must be positioned on an adjacent network segment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with administrative control over Envoy's configuration (e.g., via a compromised Kubernetes API server or Istio control plane) crafts or modifies a cluster definition so that PROXY Protocol v2 headers include TLV data totaling more than 65535 bytes. When Envoy forwards requests to the upstream service, the malformed PROXY Protocol header causes extra bytes to bleed into the HTTP/TCP stream, potentially injecting attacker-controlled content into subsequent upstream protocol units. … |
| Remediation | Upgrade Envoy to one of the patched releases: 1.35.13, 1.36.9, 1.37.5, or 1.38.3 as appropriate for the deployed branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.8
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
An issue was discovered in Envoy 1.12.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy is an open source edge and service proxy designed for cloud-native applications. Rated critical severity (CVSS 9.1
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Rated
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). R
Envoy's RBAC filter improperly concatenates duplicate HTTP headers into comma-separated strings instead of validating ea
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today