CVE-2025-62504
📋 TL;DR
Envoy proxy versions before 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script rewrites response bodies exceeding buffer limits, it causes dangling references and crashes, leading to denial of service. This affects all Envoy deployments using Lua filters with vulnerable versions.
💻 Affected Systems
- Envoy Proxy
📦 What is this software?
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
Envoy by Envoyproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage through repeated crashes, potentially affecting all traffic through the proxy
Likely Case
Intermittent crashes causing service disruption and degraded performance
If Mitigated
Limited impact with proper monitoring and rapid response to crashes
🎯 Exploit Status
Requires ability to modify or inject Lua scripts; buffer manipulation needed to trigger condition
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.36.2, 1.35.6, 1.34.10, or 1.33.12
Vendor Advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-gcxr-6vrp-wff3
Restart Required: Yes
Instructions:
1. Identify current Envoy version. 2. Upgrade to patched version matching your release line. 3. Restart Envoy service. 4. Verify version and monitor for crashes.
🔧 Temporary Workarounds
Increase buffer limits
allIncrease per_connection_buffer_limit_bytes and related buffer limits to reduce likelihood of triggering the condition
# In Envoy configuration: per_connection_buffer_limit_bytes: 10485760
# For HTTP/2: initial_stream_window_size: 10485760
Disable Lua filters
allTemporarily disable Lua filters if not essential for functionality
# Remove or comment out Lua filter configuration in Envoy config
🧯 If You Can't Patch
- Implement strict Lua script review and validation processes
- Deploy additional monitoring for Envoy crashes and restart automation
🔍 How to Verify
Check if Vulnerable:
Check Envoy version and Lua filter configuration; vulnerable if version < 1.36.2, 1.35.6, 1.34.10, or 1.33.12 AND using Lua filtersCheck Version:
envoy --versionVerify Fix Applied:
Confirm version is >= patched version and monitor for crash logs📡 Detection & Monitoring
Log Indicators:
- Envoy crash logs
- Segmentation fault errors
- Unexpected process termination
Network Indicators:
- Sudden loss of proxy connectivity
- Increased 5xx errors from upstream services
SIEM Query:
process.name="envoy" AND (event.action="crash" OR log.level="critical")