CVE-2026-47692
Envoyproxy Envoy 1.34.0 – 1.35.13
Raw vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:LSummary
CVE-2026-47692 is a medium-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Envoyproxy Envoy. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39827
Vulnerability Data
Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes…
more
written and the length field in the header. This can result in smuggled bytes on the upstream request. This vulnerability is fixed in 1.35.13, 1.36.9, 1.37.5, and 1.38.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Length inconsistency in PROXY protocol header generation in public-facing proxy enables smuggling to upstream, directly facilitating exploitation of the edge application.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the flaw by requiring prompt application of the vendor patches that correct the PROXY protocol v2 TLV length calculation.
Enforces validation of length fields in protocol headers, which would detect or block the inconsistent TLV length that enables byte smuggling.
Information-flow enforcement at the proxy boundary can constrain or sanitize PROXY-protocol metadata before it influences upstream requests.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.