Aller au contenu
en Se connecter
3.7 Faible

CVE-2025-64763 Envoy is a high-performance edge/middle/service proxy

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.

Produits et versions touchés

Produit Versions touchées Corrigé en
envoy 1.36 1.36.0 → 1.36.2 Pas de correctif indiqué
envoy 1.35 1.35.0 → 1.35.6 Pas de correctif indiqué
envoy 1.34 1.34.0 → 1.34.10 Pas de correctif indiqué
envoy 1.33 premières → 1.33.12 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de envoy

Les 98 CVE de envoy →
CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Moyenne CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 Élevée CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Moyenne CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 Élevée
Suivre cette CVE