CVE-2025-64763: Github.com/envoyproxy/envoy Envoy Forwards Early CONNECT Data Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rj35-4m94-77jh",
  "modified" : "2025-12-10T20:03:48Z",
  "published" : "2025-12-05T18:12:51Z",
  "aliases" : [ "CVE-2025-64763" ],
  "summary" : "Envoy forwards early CONNECT data in TCP proxy mode",
  "details" : "## Summary\n\nForwarding of early CONNECT data in TCP proxy mode.\n\n## Details\n\nPer [RFC 7231-4.3.6](https://www.rfc-editor.org/rfc/rfc7231#section-4.3.6) the sender of CONNECT (and all inbound proxies)  switch to tunnel mode only after receiving 2xx response. However in TCP proxy mode, Envoy accepts client data before it has issued a 2xx response and eagerly proxies it to an established TCP connection. This creates possibility of a de-synchronized tunnel state if a proxy upstream from Envoy responds with a status other an 2xx.\n\nThe RFC does not specify the behavior in case an early CONNECT data is received and early CONNECT data is common as a latency reduction mechanism. To prevent disruption to existing deployments Envoy will by default allow early CONNECT data. Setting the `envoy.reloadable_features.reject_early_connect_data` runtime flag to `true` will cause CONNECT requests that send data before 2xx response to be rejected. This options should be enabled if there are intermediaries upstream from Envoy that may reject establishment of a CONNECT tunnel. \n\n## Impact\n\nDe-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status.\n\n## Attack vector(s)\nSending data for a CONNECT request before receiving 2xx response.\n\n## Patches\nUsers should upgrade to v1.36.3, v1.35.7, v1.34.11 or v1.33.13\n\n## Credits\n\n[chasingimpact](https://github.com/chasingimpact) (Patrick)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.36.0"
      }, {
        "fixed" : "1.36.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.36.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.35.0"
      }, {
        "fixed" : "1.35.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.35.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.34.0"
      }, {
        "fixed" : "1.34.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.34.10"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/envoyproxy/envoy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.33.13"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.33.12"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-64763"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/envoyproxy/envoy"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-693" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-05T18:12:51Z",
    "nvd_published_at" : "2025-12-03T18:15:47Z"
  }
}