PT-2025-12428 · Envoy · Envoy

Published 2025-03-21 · Updated 2025-03-28 · CVE-2025-30157

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.33.1 Envoy versions prior to 1.32.4 Envoy versions prior to 1.31.6 Envoy versions prior to 1.30.10

Description The issue arises from Envoy's ext proc HTTP filter's lifetime issue, which can cause the filter to crash if a local reply is sent to the external server. A known situation that can trigger this crash is the failure of a websocket handshake, leading to a local reply.

Recommendations For versions prior to 1.33.1, update to version 1.33.1 or later. For versions prior to 1.32.4, update to version 1.32.4 or later. For versions prior to 1.31.6, update to version 1.31.6 or later. For versions prior to 1.30.10, update to version 1.30.10 or later.

Exploit

Fix

Weakness Enumeration

CWE-460

Related Identifiers

BIT-ENVOY-2025-30157

CVE-2025-30157

GHSA-CF3Q-GQG7-3FM9

OPENSUSE-SU-2025:14938-1

Affected Products

Envoy

References · 15

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30157.json · Exploit
• https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c · Patch
• https://osv.dev/vulnerability/BIT-envoy-2025-30157 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14938-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cf3q-gqg7-3fm9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30157 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30157 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://t.me/cvetracker/19624 · Telegram Post
• https://lists.opensuse.org/archives/list/[e-mail]/thread/GR5REVW6OBLYJVUSSX7MCRA6GRBMLN72 · Note
• https://t.me/cvedetector/20819 · Telegram Post
• https://suse.com/security/cve/CVE-2025-30157 · Note
• https://twitter.com/VulmonFeeds/status/1903180536925098090 · Twitter Post
• https://twitter.com/CVEnew/status/1903133169873797481 · Twitter Post