CVE-2026-47692

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2

Description The PROXY Protocol v2 header generator emits Type-Length-Values (TLVs) that exceed the maximum length of 65535 bytes. This creates a mismatch between the actual bytes written and the length field specified in the header, which can lead to smuggled bytes in the upstream request.

Recommendations Update to version 1.35.13 Update to version 1.36.9 Update to version 1.37.5 Update to version 1.38.3