Listen to this Post
In Envoy versions 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, a vulnerability exists in TCP proxy mode when handling CONNECT requests. Envoy accepts client data before issuing a 2xx response and forwards this early data to the upstream TCP connection. If a forwarding proxy upstream from Envoy responds with a non-2xx status, it causes a de-synchronized CONNECT tunnel state. By default, Envoy allows early CONNECT data to avoid disrupting existing deployments, but this behavior can be exploited. The de-synchronization occurs because Envoy continues to proxy data even after a negative upstream response, which should terminate the tunnel. This inconsistency can lead to unauthorized data flow, connection instability, or potential denial of service. The issue is specific to CONNECT request handling where intermediaries upstream may reject tunnel establishment. The vulnerability stems from the lack of synchronization between client data transmission and upstream response validation. Mitigation involves setting a runtime flag to reject early CONNECT data, but this is disabled by default for compatibility.
Platform: Envoy
Version: Up to 1.36.2
Vulnerability: CONNECT tunnel desynchronization
Severity: Medium
Date: 12/03/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
envoy --version curl -X CONNECT http://proxy:port --data "early data" echo "envoy.reloadable_features.reject_early_connect_data: true" >> runtime.yaml
How Exploit:
Attackers send CONNECT requests with early data to Envoy configured as TCP proxy. Upstream proxies responding with non-2xx status cause tunnel state desynchronization, potentially leaking data or disrupting connections.
Protection from this CVE:
Enable runtime flag envoy.reloadable_features.reject_early_connect_data to true. Update Envoy to patched versions when available. Configure upstream proxies to handle CONNECT tunnels consistently.
Impact:
Data leakage, connection instability, denial of service in vulnerable Envoy deployments with specific TCP proxy configurations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
