A critical HTTP request smuggling vulnerability in Envoy Proxy allows unauthenticated remote attackers to intercept or access sensitive data belonging to other users.

This flaw involves inconsistent interpretation of HTTP requests (CWE-444) where the proxy forwards data for a non-WebSocket HTTP upgrade prematurely. An unauthenticated attacker can exploit this to smuggle responses into a shared connection pool, which may subsequently be delivered to an entirely different downstream client.

The vulnerability poses a severe risk to data confidentiality, as it permits unauthorized access to sensitive information transmitted through the proxy. Given the CVSS score of 7.5, this high-severity flaw could lead to cross-user data leakage, potentially exposing authentication tokens, session cookies, or private user data. Such an incident could result in significant reputational damage and a loss of user trust in the security of the cloud-native infrastructure.

Immediate Action: Upgrade to Envoy versions 1.36.10, 1.37.6, 1.38.4, or 1.39.1 immediately to incorporate the necessary security patches.

Proactive Monitoring: Inspect traffic logs for unusual HTTP upgrade patterns or unexpected response headers that might indicate attempted smuggling attacks.

Compensating Controls: If immediate patching is not feasible, consider disabling non-essential HTTP upgrade configurations or enforcing strict connection management policies, such as setting max_requests_per_connection to 1 for affected upstreams.

Public Exploit Available: No

Organizations utilizing Envoy as an edge or service proxy must prioritize this update, as the flaw allows for the compromise of communication integrity between clients and services. Please verify your current deployment version and apply the recommended patches to all affected nodes to mitigate the risk of data smuggling and unauthorized information disclosure.