CVE-2025-54588
📋 TL;DR
This CVE describes a use-after-free vulnerability in Envoy's DNS cache within the Dynamic Forward Proxy implementation. It can cause abnormal process termination (crash) when specific callback conditions trigger new DNS resolutions while removing pending ones. Affected systems are Envoy deployments with dynamic forwarding filter enabled and specific runtime flags set.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing Envoy proxy crashes, disrupting all traffic routing through affected instances and potentially cascading to dependent services.
Likely Case
Intermittent Envoy process crashes leading to service disruptions, connection drops, and degraded performance until processes restart.
If Mitigated
With proper monitoring and automatic restart mechanisms, impact is limited to brief service interruptions during crash/recovery cycles.
🎯 Exploit Status
Exploitation requires specific configuration conditions but no authentication. Triggering requires manipulating traffic to create the callback race condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.34.5, 1.35.1
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw
Restart Required: Yes
Instructions:
1. Download patched version from official releases. 2. Replace existing Envoy binary. 3. Restart Envoy service. 4. Verify version with envoy --version.
🔧 Temporary Workarounds
Disable runtime flag
allSet the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false to prevent the vulnerable code path.
Set runtime flag: envoy.reloadable_features.dfp_cluster_resolves_hosts = false
🧯 If You Can't Patch
- Disable dynamic Forwarding Filter if not required for functionality
- Implement aggressive health checking and automatic restart for Envoy processes
🔍 How to Verify
Check if Vulnerable:
Check Envoy version with 'envoy --version' and verify configuration has dynamic Forwarding Filter enabled with the problematic runtime flag.Check Version:
envoy --versionVerify Fix Applied:
Confirm version is 1.34.5+ or 1.35.1+ and monitor for abnormal process terminations.📡 Detection & Monitoring
Log Indicators:
- Envoy process crashes
- Abnormal termination messages
- DNS resolution errors in logs
Network Indicators:
- Sudden drops in proxy traffic
- Increased connection timeouts
- DNS query failures
SIEM Query:
process.name="envoy" AND (event.action="crash" OR log.level="error" AND message CONTAINS "termination")