CVE-2025-64763

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Dec 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-647645.4Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the t CVE-2025-647655.3Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and ho CVE-2025-647665.3NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions CVE-2025-647679.1hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderConte CVE-2025-647697.1The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subj CVE-2025-64774.8A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as problematic. Affected by this vuln CVE-2025-647706.8The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may allow an attacker unaut CVE-2025-647728.4The installer of INZONE Hub 1.0.10.3 to 1.0.17.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li CVE-2025-647733.7In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit CVE-2025-647757.5Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-647767.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2025-647787.8NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwo