CVE-2025-62504
Description
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
How to fix
- envoyproxy envoy1.33.12, 1.34.10, 1.35.6, 1.36.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| envoyproxy envoy | v < 1.33.12, 1.34.0 ≤ v < 1.34.10, 1.35.0 ≤ v < 1.35.6, 1.36.0 ≤ v < 1.36.2 | 1.33.12, 1.34.10, 1.35.6, 1.36.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.