UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64763

Forwarding of early CONNECT data in TCP proxy mode

Severity
Medium 5.3
Published
3 Dec 2025
Last changed
24 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.13, 1.34.11, 1.35.7, 1.36.3
Also known as
GHSA-rj35-4m94-77jh
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.33.13
  • From 1.34.0 before 1.34.11
  • From 1.35.0 before 1.35.7
  • From 1.36.0 before 1.36.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.33.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64763
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64763
  • GitHub Advisory Database https://github.com/advisories/GHSA-rj35-4m94-77jh
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh