PT-2025-42550 · Envoy · Envoy

Published 2025-10-16 · Updated 2025-10-21 · CVE-2025-62504

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.2 Envoy versions prior to 1.35.6 Envoy versions prior to 1.34.10 Envoy versions prior to 1.33.12

Description Envoy, an open source edge and service proxy, has a memory safety issue in the Lua filter. When a Lua script modifies a response body to exceed the per connection buffer limit bytes configuration (defaulting to 1MB) during the response phase, Envoy creates a local reply that overwrites original response headers, leading to dangling references and a potential denial of service.

Recommendations Update to Envoy version 1.36.2 Update to Envoy version 1.35.6 Update to Envoy version 1.34.10 Update to Envoy version 1.33.12

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BIT-ENVOY-2025-62504

CVE-2025-62504

GHSA-GCXR-6VRP-WFF3

OPENSUSE-SU-2025:15655-1

Affected Products

Envoy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62504.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-gcxr-6vrp-wff3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62504 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2025-62504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62504 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15655-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2025-62409 · Note
• https://t.me/CVEtracker/35160 · Telegram Post
• https://t.me/cveNotify/139084 · Telegram Post
• https://twitter.com/CVEnew/status/1978938148857221173 · Twitter Post
• https://suse.com/security/cve/CVE-2025-62504 · Note
• https://twitter.com/VulmonFeeds/status/1979046265347289467 · Twitter Post