Input validation error in envoy - CVE-2026-47692

Detailed vulnerability description

The vulnerability allows a remote privileged user to inject attacker-controlled bytes into the upstream application stream.

The vulnerability exists due to improper input validation in generateV2Header() in source/extensions/common/proxy_protocol/proxy_protocol_header.cc when generating a PROXY protocol v2 header with pass-through TLVs and added TLVs that exceed the 65535-byte limit. A remote privileged user can supply crafted TLV content that is emitted beyond the advertised header length to inject attacker-controlled bytes into the upstream application stream.

The issue is reachable in configurations that use the listener proxy_protocol filter with pass_through_tlvs together with upstream_proxy_protocol v2 and at least one added_tlvs entry.

How to mitigate CVE-2026-47692

Sources

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r
• https://github.com/envoyproxy/envoy/pull/37591