The PROXY Protocol v2 header generator in Envoy creates TLVs that can exceed the 65535‑byte length limit. The generated header contains a smaller length field than the number of bytes actually written, causing a mismatch. As a result, up to 65 kilobytes of attacker‑controlled data can be inserted into the upstream request stream when a malicious header is sent. This malformed data bypasses normal parsing and can expose upstream services to data corruption or hidden payloads, leading to information leakage.

Envoy proxy versions 1.34.0 through 1.35.12, 1.36.0‑1.36.8, 1.37.0‑1.37.4, and 1.38.0‑1.38.2 are affected. The vulnerability is fixed in releases 1.35.13, 1.36.9, 1.37.5, 1.38.3, or any later version.

The CVSS score of a moderate risk. EPSS data is not available, so the current likelihood of exploitation is unclear. The flaw can be exploited when traffic containing a crafted PROXY Protocol v2 header reaches a listener that is configured to accept the protocol; the attacker only needs network access to the listener and can target a PROXY‑enabled listener.