PT-2025-35643 · Envoy · Envoy

Agrawroh · Published 2025-09-02 · Updated 2025-09-15 · CVE-2025-54588

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions 1.34.0 through 1.34.4 Envoy version 1.35.0

Description Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Affected versions contain a use-after-free (UAF) vulnerability in the DNS cache, leading to abnormal process termination. The issue occurs in Envoy's Dynamic Forward Proxy implementation when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the dynamic Forwarding Filter is enabled, the envoy.reloadable features.dfp cluster resolves hosts runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters.

Recommendations Envoy versions 1.34.0 through 1.34.4: Upgrade to version 1.34.5 or later. Envoy version 1.35.0: Upgrade to version 1.35.1 or later. As a workaround for all affected versions, set the envoy.reloadable features.dfp cluster resolves hosts runtime flag to false.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-ENVOY-2025-54588

CVE-2025-54588

GHSA-G9VW-6PVX-7GMW

Affected Products

Envoy

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54588.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g9vw-6pvx-7gmw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54588 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54588 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2025-54588 · Vendor Advisory
• https://github.com/envoyproxy/envoy/releases/tag/v1.34.5 · Note
• https://github.com/envoyproxy/envoy/releases/tag/v1.35.1 · Note
• https://github.com/envoyproxy/envoy · Note
• https://twitter.com/CrowdCyber_Com/status/1963177628736573577 · Twitter Post
• https://t.me/cveNotify/134632 · Telegram Post
• https://t.me/pentestingnews/67445 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1963159599466303511 · Twitter Post
• https://twitter.com/fridaysecurity/status/1963178797131268539 · Twitter Post
• https://twitter.com/cracbot/status/1965007244904243403 · Twitter Post