CVE-2025-64763
Last modified
CVE-2025-64763 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwarding proxy upstream from Envoy then responds with a non-2xx status, this can cause a de-synchronized CONNECT tunnel state. By default Envoy continues to allow early CONNECT data to avoid disrupting existing deployments. The envoy.reloadable_features.reject_early_connect_data runtime flag can be set to reject CONNECT requests that send data before a 2xx response when intermediaries upstream from Envoy may reject establishment of a CONNECT tunnel.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Envoyproxy | Envoy | < 1.33.13 |
| Envoyproxy | Envoy | >= 1.34.0, < 1.34.11 |
| Envoyproxy | Envoy | >= 1.35.0, < 1.35.7 |
| Envoyproxy | Envoy | >= 1.36.0, < 1.36.3 |
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jhPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-64763?
How severe is CVE-2025-64763?
How do I fix CVE-2025-64763?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-64758@dependencytrack/frontend is a Single Page Application (SPA)…4.8
- CVE-2025-64759Homarr is an open-source dashboard. Prior to version 1.43.3,…6.1
- CVE-2025-6476A vulnerability was found in SourceCodester Gym Management S…4.3
- CVE-2025-64760Tuleap is a free and open source suite for management of sof…4.3
- CVE-2025-64761OpenBao is an open source identity-based secrets management …7.2
- CVE-2025-64762The AuthKit library for Next.js provides convenient helpers …9.1
- CVE-2025-64764Astro is a web framework. Prior to version 5.15.8, a reflect…5.4
- CVE-2025-64765Astro is a web framework. Prior to version 5.15.8, a mismatc…5.3
- CVE-2025-64766NixOS's Onlyoffice is a software suite that offers online an…5.3
- CVE-2025-64767hpke-js is a Hybrid Public Key Encryption (HPKE) module buil…9.1
- CVE-2025-64769The Process Optimization application suite leverages connect…7.6
- CVE-2025-6477A vulnerability was found in SourceCodester Student Result M…4.8
Are you affected by CVE-2025-64763?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST