CVE-2025-64763
📋 TL;DR
Envoy proxy versions 1.33.12, 1.34.10, 1.35.6, 1.36.2 and earlier have a CONNECT tunnel desynchronization vulnerability when configured in TCP proxy mode. This occurs when Envoy accepts client data before issuing a 2xx response and forwards it upstream, but an upstream proxy responds with a non-2xx status. Organizations using Envoy as a TCP proxy with CONNECT requests are affected.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
CONNECT tunnel desynchronization could lead to data being forwarded incorrectly, potentially causing service disruption or data leakage between client connections.
Likely Case
Service disruption where CONNECT tunnels fail to establish properly, causing connection failures for clients using the proxy.
If Mitigated
Minimal impact with proper configuration controls in place.
🎯 Exploit Status
Exploitation requires specific configuration (TCP proxy mode with CONNECT handling) and upstream proxy that may reject CONNECT establishment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in versions after those listed (check latest releases)
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh
Restart Required: Yes
Instructions:
1. Update Envoy to latest patched version. 2. Set envoy.reloadable_features.reject_early_connect_data runtime flag to true. 3. Restart Envoy service.
🔧 Temporary Workarounds
Enable reject_early_connect_data flag
allSet runtime flag to reject CONNECT requests that send data before a 2xx response
Set envoy.reloadable_features.reject_early_connect_data = true in runtime configuration
🧯 If You Can't Patch
- Enable the envoy.reloadable_features.reject_early_connect_data runtime flag
- Consider disabling TCP proxy mode for CONNECT requests if not required
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and configuration for TCP proxy mode with CONNECT handlingCheck Version:
envoy --versionVerify Fix Applied:
Verify Envoy version is patched and reject_early_connect_data flag is enabled📡 Detection & Monitoring
Log Indicators:
- Failed CONNECT tunnel establishment
- Non-2xx responses from upstream proxies during CONNECT
Network Indicators:
- Unexpected connection failures in TCP proxy mode
- CONNECT request/response mismatches
SIEM Query:
envoy_logs | where message contains "CONNECT" and (status_code != 200 or error contains "tunnel")