CVE-2025-62409
📋 TL;DR
This vulnerability in Envoy proxy allows large requests/responses to trigger TCP connection pool crashes when connections close while upstream data is still arriving, causing a null pointer dereference. It affects TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. Organizations using vulnerable Envoy versions as edge or service proxies are impacted.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing Envoy proxy crashes, disrupting traffic routing and potentially cascading to dependent services.
Likely Case
Intermittent connection failures and service disruptions under specific traffic patterns with large payloads.
If Mitigated
Minimal impact with proper monitoring and rapid restart capabilities.
🎯 Exploit Status
Exploitation requires specific timing and traffic patterns but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.33.10, 1.34.9, 1.35.5, or 1.36.1
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3
Restart Required: Yes
Instructions:
1. Identify Envoy version currently deployed. 2. Upgrade to patched version (1.33.10, 1.34.9, 1.35.5, or 1.36.1). 3. Restart Envoy service. 4. Verify new version is running.
🔧 Temporary Workarounds
Limit request/response sizes
allConfigure Envoy to reject or limit large requests/responses that could trigger the vulnerability
# Add to Envoy configuration:
max_request_bytes: 1048576
max_response_bytes: 1048576
Disable mixed HTTP protocols
allAvoid HTTP 1 & 2 mixed use cases if not required
# Configure consistent HTTP protocol usage in listeners
🧯 If You Can't Patch
- Implement rate limiting and request size restrictions at load balancer level
- Deploy redundant Envoy instances with automatic failover to minimize disruption
🔍 How to Verify
Check if Vulnerable:
Check Envoy version with 'envoy --version' or examine deployment manifests. Compare against affected versions.Check Version:
envoy --versionVerify Fix Applied:
Confirm version is 1.33.10, 1.34.9, 1.35.5, or 1.36.1. Monitor for connection pool crashes after patch.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors
- Connection pool crash logs
- Unexpected Envoy process termination
Network Indicators:
- Sudden increase in TCP connection failures
- HTTP 502/503 errors from Envoy
SIEM Query:
source="envoy" AND ("segmentation fault" OR "null pointer" OR "crash" OR "SIGSEGV")