PT-2025-48970 · Envoy · Envoy

Published 2025-12-03 · Updated 2025-12-06 · CVE-2025-64763

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions 1.33.12 through 1.36.2

Description Envoy, a high-performance edge/middle/service proxy, has an issue when configured in TCP proxy mode to handle CONNECT requests. It accepts client data before issuing a 2xx response and forwards this data to the upstream TCP connection. If a forwarding proxy upstream from Envoy responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default, Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable features.reject early connect data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.

Recommendations Set the envoy.reloadable features.reject early connect data runtime flag to reject CONNECT requests that send data before a 2xx response.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

BIT-ENVOY-2025-64763

CVE-2025-64763

GHSA-RJ35-4M94-77JH

Affected Products

Envoy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64763.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64763 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rj35-4m94-77jh · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2025-64763 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://t.me/CVEtracker/38772 · Telegram Post
• https://twitter.com/CVEnew/status/1996284706485141839 · Twitter Post
• https://t.me/cveNotify/144907 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1996405774608719937 · Twitter Post