PT-2025-48969 · Envoy · Envoy

Published 2025-12-03 · Updated 2025-12-06 · CVE-2025-64527

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions 1.33.12 through 1.36.2

Description Envoy, a high-performance edge/middle/service proxy, experiences crashes when JWT authentication is configured with remote JWKS fetching enabled, allow missing or failed is set to true, multiple JWT tokens are present in the request headers, and the JWKS fetch fails. This issue stems from a re-entry bug within the JwksFetcherImpl component. Specifically, when the initial token's JWKS fetch fails, the onJwksError() callback initiates processing of the subsequent token, triggering another fetch() call on the same fetcher object. The subsequent reset() operation then clears the state of the second fetch, leading to a crash upon the arrival of the asynchronous HTTP response.

Recommendations Update to a version later than 1.36.2.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-ENVOY-2025-64527

CVE-2025-64527

GHSA-MP85-7MRQ-R866

Affected Products

Envoy

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64527.json · Exploit
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2025-64527 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mp85-7mrq-r866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64527 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64527 · Vendor Advisory
• https://github.com/envoyproxy/envoy · Note
• https://twitter.com/CVEnew/status/1996284707353313499 · Twitter Post
• https://t.me/CVEtracker/38771 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1996408334522421684 · Twitter Post
• https://t.me/cveNotify/144906 · Telegram Post