-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/envoyproxy/envoy | go | >= 1.36.0, <= 1.36.2 | 1.36.3 |
| github.com/envoyproxy/envoy | go | >= 1.35.0, <= 1.35.6 | 1.35.7 |
| github.com/envoyproxy/envoy | go | >= 1.34.0, <= 1.34.10 | 1.34.11 |
| github.com/envoyproxy/envoy | go | <= 1.33.12 | 1.33.13 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in Envoy's handling of TCP CONNECT requests, where it forwards data from the client before the CONNECT tunnel is fully established. This can cause issues with upstream proxies. The analysis of the provided patch commit daefd2f7b3fc2f1c24830ba092d9ca19213b1f39 clearly points to the Envoy::Router::Filter::decodeData function as the location of the vulnerability. The patch modifies this function to add a check for 'early data' in CONNECT requests. A new helper function, isEarlyConnectData, is introduced, which is called from decodeData. If early data is detected and the corresponding runtime feature is enabled, the request is rejected with a 400 Bad Request status. This change directly addresses the reported vulnerability. The other changes in the commit are related to different CVEs and are not relevant to this analysis. Therefore, Envoy::Router::Filter::decodeData is the primary function that would be observed in a runtime profile during the exploitation of this vulnerability.
Envoy::Router::Filter::decodeDatasource/common/router/router.cc
A Semantic Attack on Google Gemini - Read the Latest Research