CVE-2026-47692: Envoyproxy Envoy DOS Vulnerability

CVE-2026-47692 Overview

CVE-2026-47692 affects Envoy, an open source edge and service proxy widely deployed in cloud-native environments. The vulnerability exists in the PROXY Protocol v2 header generator, which emits Type-Length-Value (TLV) fields beyond the maximum allowable length of 65535 bytes. This creates a mismatch between the actual bytes written and the length field declared in the PROXY Protocol header. Attackers on an adjacent network can leverage this mismatch to smuggle bytes onto the upstream request. The issue affects Envoy versions from 1.34.0 up to (but not including) 1.35.13, 1.36.9, 1.37.5, and 1.38.3, where it is fixed.

Critical Impact
A length field mismatch in generated PROXY Protocol v2 headers allows an adjacent attacker to smuggle bytes into upstream requests, potentially bypassing security controls or influencing backend request interpretation.

Affected Products

Envoy proxy versions 1.34.0 through 1.35.12
Envoy proxy versions 1.36.0 through 1.36.8
Envoy proxy versions 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2

Discovery Timeline

2026-06-26 - CVE-2026-47692 published to NVD
2026-06-27 - Last updated in NVD database

Technical Details for CVE-2026-47692

Vulnerability Analysis

The vulnerability is classified under [CWE-130] (Improper Handling of Length Parameter Inconsistency). Envoy's PROXY Protocol v2 header generator constructs headers that carry connection metadata using TLV records. The PROXY Protocol v2 specification limits the total header payload length to 65535 bytes, encoded in a 16-bit length field. When TLV data exceeds this ceiling, the generator continues emitting bytes onto the wire without adjusting or capping the declared length field. The upstream receiver reads only the number of bytes indicated by the length field, leaving the remaining bytes in the connection stream. Those trailing bytes are then interpreted as the beginning of the next protocol message, such as an HTTP request. This confusion between framing boundaries is the core mechanism enabling request smuggling.

Root Cause

The root cause is missing validation of the total TLV payload size against the PROXY Protocol v2 length field ceiling of 65535 bytes. The header generator writes all provided TLVs to the output buffer without truncating, rejecting, or splitting oversized payloads. As a result, the header claims a smaller length than the actual bytes written.

Attack Vector

The attack requires an adjacent network position where the attacker can influence the metadata or TLV inputs used to construct the PROXY Protocol v2 header emitted by Envoy toward an upstream service. When the generated header carries oversized TLVs, the length field understates the true byte count. The upstream service consumes the declared length as PROXY Protocol metadata and treats the remaining smuggled bytes as the start of the next request. An attacker who can shape those trailing bytes can inject unauthorized upstream requests or manipulate request parsing at the backend. Refer to the Envoy GitHub Security Advisory GHSA-wh36-hm39-mm3r for technical details on the affected code paths.

Detection Methods for CVE-2026-47692

Indicators of Compromise

Unexpected upstream HTTP requests that do not correspond to downstream client requests observed at the Envoy listener.
Backend access logs containing malformed request lines or request fragments prefixed by binary PROXY Protocol residue.
Elevated frequency of TLV entries in outbound PROXY Protocol v2 headers approaching or exceeding the 65535-byte boundary.

Detection Strategies

Inspect PROXY Protocol v2 headers on upstream connections and flag any where the sum of TLV lengths does not match the declared 16-bit length field.
Correlate downstream request counts with upstream request counts per connection; smuggling produces more upstream requests than downstream ones.
Deploy protocol-aware network monitoring between Envoy and upstream services to identify framing anomalies.

Monitoring Recommendations

Enable verbose access logging on both Envoy and upstream services and alert on request desynchronization patterns.
Track the Envoy release version in use across all fleet nodes and flag any instance running an unpatched build in the 1.34.0–1.38.2 range.
Monitor connection-level metrics for oversized header emissions from the PROXY Protocol v2 generator.

How to Mitigate CVE-2026-47692

Immediate Actions Required

Upgrade Envoy to 1.35.13, 1.36.9, 1.37.5, or 1.38.3 depending on your current minor release track.
Audit all listeners and clusters configured with the PROXY Protocol v2 upstream transport socket and confirm the size of TLV inputs.
Restrict adjacent network access to Envoy instances that emit PROXY Protocol v2 headers upstream until the patch is applied.

Patch Information

The Envoy maintainers fixed the vulnerability in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Patch details and the official fix are documented in the Envoy GitHub Security Advisory GHSA-wh36-hm39-mm3r.

Workarounds

Disable PROXY Protocol v2 header generation on upstream transport sockets if the feature is not strictly required.
Constrain the size and number of TLV entries added to generated PROXY Protocol v2 headers so that total payload stays well below 65535 bytes.
Terminate PROXY Protocol at a trusted intermediary that validates length-field consistency before forwarding to backend services.

bash

# Configuration example: disable PROXY Protocol v2 on upstream transport socket
# in the Envoy cluster configuration if not required
transport_socket:
  name: envoy.transport_sockets.raw_buffer
# Remove or comment out any envoy.transport_sockets.upstream_proxy_protocol
# entries configured with config.version: V2 until patched builds are deployed.