CVE-2025-54588 Details
Description
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.
A use-after-free vulnerability has been identified in Envoy versions 1.34.0 prior to 1.34.4 and 1.35.0, within the DNS cache. This vulnerability causes abnormal process termination and is related to Envoy's Dynamic Forward Proxy implementation. The issue arises when a completion callback for a DNS resolution either triggers new DNS resolutions or removes existing pending ones. This scenario can occur if the Dynamic Forwarding Filter is enabled, the 'envoy.reloadable_features.dfp_cluster_resolves_hosts' runtime flag is active, and the Host header is altered between the Dynamic Forwarding Filter and Router filters.
Users should upgrade to Envoy versions 1.34.5 or 1.35.1. If an immediate upgrade is not possible, the 'envoy.reloadable_features.dfp_cluster_resolves_hosts' runtime flag can be set to false as a temporary workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/releases/tag/v1.34.5 | [email protected] | Release Notes |
| https://github.com/envoyproxy/envoy/releases/tag/v1.35.1 | [email protected] | Release Notes |
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | >= 1.34.0, < 1.34.5 1.35.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2025 | Initial Analysis | [email protected] |
| Sep 3, 2025 | New CVE Received | [email protected] |