PT-2025-42518 · Envoy · Envoy

Published 2025-10-16 · Updated 2025-10-29 · CVE-2025-62409

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.1 Envoy versions prior to 1.35.5 Envoy versions prior to 1.34.9 Envoy versions prior to 1.33.10

Description Envoy is a cloud-native, open source edge and service proxy. Large requests and responses can potentially trigger TCP connection pool crashes due to flow control management within Envoy. This occurs when a connection is closing but upstream data is still being received, resulting in a buffer watermark callback referencing a null pointer. The issue impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN.

Recommendations Update to Envoy version 1.36.1. Update to Envoy version 1.35.5. Update to Envoy version 1.34.9. Update to Envoy version 1.33.10.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-ENVOY-2025-62409

CVE-2025-62409

GHSA-PQ33-4JXH-HGM3

OPENSUSE-SU-2025:15655-1

Affected Products

Envoy

References · 12

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62409.json · Exploit
• https://osv.dev/vulnerability/BIT-envoy-2025-62409 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15655-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62409 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62409 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-62409 · Note
• https://twitter.com/VulmonFeeds/status/1978997628848222312 · Twitter Post
• https://t.me/CVEtracker/35132 · Telegram Post
• https://suse.com/security/cve/CVE-2025-62504 · Note
• https://twitter.com/CVEnew/status/1978926570333945971 · Twitter Post
• https://t.me/cveNotify/140878 · Telegram Post