CVE-2025-64763: Envoyproxy Envoy DoS Vulnerability

CVE-2025-64763 Overview

CVE-2025-64763 affects Envoy, a high-performance edge, middle, and service proxy widely deployed in service mesh and API gateway architectures. When Envoy operates in TCP proxy mode handling CONNECT requests, it accepts client payload data before the upstream returns a 2xx response. Envoy forwards that early data to the upstream TCP connection. If a forwarding proxy upstream returns a non-2xx status, the CONNECT tunnel state becomes desynchronized between client and upstream. This weakness is classified as [CWE-693] Protection Mechanism Failure and impacts confidentiality by allowing data to leak into a tunnel that was never successfully established.

Critical Impact
Early CONNECT data forwarded before upstream acceptance can produce a desynchronized tunnel state, exposing client data when an intermediate proxy rejects the tunnel.

Affected Products

Envoy versions up to and including 1.33.12
Envoy versions up to and including 1.34.10
Envoy versions up to and including 1.35.6 and 1.36.2

Discovery Timeline

2025-12-03 - CVE-2025-64763 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64763

Vulnerability Analysis

Envoy's TCP proxy handles HTTP CONNECT requests to establish tunnels for arbitrary TCP traffic. The default behavior allows client payload data to flow to the upstream before Envoy has confirmed a 2xx response from that upstream. This design preserves compatibility with existing deployments but breaks the semantics of the CONNECT method as defined in the HTTP specification, where a tunnel must only carry payload after successful establishment.

The network-based attack requires no authentication or user interaction, but the impact is limited to confidentiality of the pre-tunnel bytes. Integrity and availability are not affected.

Root Cause

The root cause is a protection mechanism failure in the TCP proxy filter. Envoy proxies bytes from the downstream client to the upstream socket as soon as the CONNECT request is parsed. It does not gate that forwarding on receipt of the upstream 2xx acknowledgement. When an upstream forwarding proxy later returns a non-2xx status, the client has already committed data to a tunnel that will not be established, producing state desynchronization.

Attack Vector

An attacker positioned to influence CONNECT request routing through Envoy toward a forwarding proxy that may reject the tunnel can observe or capture early client data. The exploitation flow proceeds as follows: the client sends CONNECT target:port HTTP/1.1 followed immediately by application payload; Envoy relays the payload to the upstream; the upstream forwarding proxy returns a non-2xx response; the tunnel fails but the early bytes have already been transmitted downstream of the rejection point. The envoy.reloadable_features.reject_early_connect_data runtime flag controls the mitigation but is disabled by default to preserve existing deployment behavior.

No verified public exploit code is available. See the Envoy GitHub Security Advisory GHSA-rj35-4m94-77jh for technical details.

Detection Methods for CVE-2025-64763

Indicators of Compromise

Envoy access logs showing CONNECT requests where upstream responses are non-2xx (4xx or 5xx) yet downstream byte counters are non-zero before the response was received.
Correlated upstream forwarding proxy logs recording CONNECT rejections that immediately follow client payload delivery.
Unexpected TCP payload fragments arriving at forwarding proxies for tunnels that were never confirmed.

Detection Strategies

Inspect Envoy TCP proxy statistics for tcp.upstream_flush_active and cx_tx_bytes_total values recorded against failed CONNECT establishment events.
Compare downstream-to-upstream byte accounting against CONNECT response codes to identify pre-2xx data forwarding.
Deploy protocol-aware network monitoring at the Envoy egress boundary to flag CONNECT payloads that precede upstream 2xx responses.

Monitoring Recommendations

Enable structured access logging on all Envoy listeners handling CONNECT traffic and forward logs to a centralized analytics platform.
Alert on any Envoy fleet member running an affected version (1.33.12, 1.34.10, 1.35.6, 1.36.2, or earlier) without the reject_early_connect_data runtime flag set.
Track configuration drift for the envoy.reloadable_features.reject_early_connect_data flag across all environments.

How to Mitigate CVE-2025-64763

Immediate Actions Required

Inventory all Envoy deployments and identify instances running affected versions in TCP proxy mode with CONNECT handling enabled.
Enable the envoy.reloadable_features.reject_early_connect_data runtime flag on any Envoy that fronts a forwarding proxy which may reject CONNECT tunnel establishment.
Upgrade Envoy to a patched release published in the vendor advisory when a maintenance window is available.
Review upstream forwarding proxy policies to determine where CONNECT rejections are possible.

Patch Information

Refer to the Envoy GitHub Security Advisory GHSA-rj35-4m94-77jh for fixed versions and patch details. The advisory documents both the runtime flag mitigation and the patched release lines for 1.33.x, 1.34.x, 1.35.x, and 1.36.x branches.

Workarounds

Set envoy.reloadable_features.reject_early_connect_data=true via the runtime configuration layer to reject CONNECT requests that carry data before a 2xx response.
Restrict CONNECT method usage in TCP proxy listeners where forwarding-proxy rejection is a plausible outcome.
Terminate CONNECT tunnels at Envoy rather than chaining through a secondary forwarding proxy that can reject the tunnel.

bash

# Configuration example - enable the runtime flag via Envoy bootstrap
layered_runtime:
  layers:
    - name: static_layer
      static_layer:
        envoy.reloadable_features.reject_early_connect_data: true