Executive Summary

The CVE-2026-47692 vulnerability in Envoy Proxy is caused by a flaw in the PROXY Protocol v2 header generator. Specifically, the generator emits Type-Length-Value (TLV) entries that exceed the maximum allowed length of 65535 bytes, resulting in a mismatch between the actual bytes written and the length field in the header.

This mismatch allows an attacker to inject or "smuggle" extra bytes into the upstream application stream beyond what Envoy advertises, effectively bypassing Envoy's filtering mechanisms.

The issue arises because the generator incorrectly includes TLVs that are too large, and this bug was introduced in February 2025 affecting Envoy versions from 1.34.0 up to 1.39.

The vulnerability requires a specific configuration (AWS listener pattern with pass_through_tlvs) to be exploitable and was fixed by correcting a variable name in the code to ensure only valid TLVs are included.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to bypass Envoy's security filters such as HTTP connection manager, RBAC (Role-Based Access Control), or JWT (JSON Web Token) validation.

Because the attacker can smuggle extra bytes into the upstream application stream, malicious payloads or unauthorized requests might reach your backend services undetected.

This can lead to unauthorized access, data manipulation, or denial of service depending on the nature of the upstream application and the attacker's intent.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the PROXY Protocol v2 header generator emitting TLVs beyond the maximum length of 65535 bytes, causing smuggled bytes to bypass filters and reach the upstream application.

Detection would involve monitoring network traffic for PROXY Protocol v2 headers where the length field does not match the actual size of the TLVs, indicating a possible overflow or smuggling attempt.

Specific commands or tools are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed in Envoy Proxy versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

Immediate mitigation involves upgrading your Envoy Proxy to one of these fixed versions to ensure the PROXY Protocol v2 header generator correctly limits TLV lengths and prevents smuggling.

Additionally, review your configuration for the AWS listener pattern with pass_through_tlvs, as this specific setup is required for exploitation.

Useful 0 Not Useful 0