CVE-2026-47692 describes an improper handling of length parameter inconsistency (CWE-130) in the Envoy proxy's PROXY Protocol v2 header generator. Specifically, in versions from 1.34.0 until the fixed versions, the generator emits TLVs beyond the maximum length of 65535 bytes. This causes a mismatch between the actual bytes written and the length field in the header, potentially allowing smuggled bytes to be sent upstream. The vulnerability has a CVSS 3.1 base score of 4.8 (medium severity), with attack vector being adjacent network, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, low integrity impact, and low availability impact. The issue is fixed in versions 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

The vulnerability can cause smuggling of bytes on upstream requests due to length field inconsistencies in the PROXY Protocol v2 header. This may lead to integrity and availability impacts as indicated by the CVSS vector, but no confidentiality impact is noted. Exploitation requires high privileges and access from an adjacent network. No known exploits are reported in the wild.

Fixed versions are 1.35.13, 1.36.9, 1.37.5, and 1.38.3. Users should upgrade to these versions to remediate the vulnerability. Patch status is confirmed by the description indicating these versions contain the fix. No additional vendor advisory was provided. No cloud service is involved, so remediation depends on user upgrades.