CVE-2025-64763 Details
Description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
A vulnerability exists in Envoy versions through 1.36.2 that impacts TCP proxy mode handling of CONNECT requests. Envoy forwards client data to upstream TCP connections before acknowledging the request with a 2xx response. If an upstream forwarding proxy then responds with a non-2xx status, it can lead to a de-synchronized CONNECT tunnel state. This behavior, allowed by default to maintain compatibility with existing deployments, can be problematic if upstream proxies may reject the CONNECT tunnel establishment. The issue can be mitigated by setting the 'envoy.reloadable_features.reject_early_connect_data' runtime flag to true, which will reject early CONNECT data in such scenarios.
Users are advised to upgrade to Envoy versions 1.36.3, 1.35.7, 1.34.11, or 1.33.13. Additionally, the 'envoy.reloadable_features.reject_early_connect_data' runtime flag can be set to true to reject early CONNECT data, especially when upstream proxies may reject the CONNECT tunnel establishment.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | < 1.33.13 >= 1.34.0, < 1.34.11 >= 1.35.0, < 1.35.7 >= 1.36.0, < 1.36.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | Initial Analysis | [email protected] |
| Dec 3, 2025 | New CVE Received | [email protected] |