CVE-2025-62504 Details
Description
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
A use-after-free vulnerability has been identified in the Lua filter of Envoy, an open-source edge and service proxy. This vulnerability affects Envoy versions prior to 1.36.2, 1.35.6, 1.34.10, and 1.33.12. The issue arises when a Lua script, during the response phase, modifies a response body to exceed the 'per_connection_buffer_limit_bytes' (default 1MB). This causes Envoy to generate a local reply that overrides the original response headers, creating dangling references that lead to a crash, thereby causing a denial-of-service condition.
Users can update to Envoy versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 to address this vulnerability. Alternatively, the 'per_connection_buffer_limit_bytes' can be increased, along with the 'initial_stream_window_size' for HTTP/2. The 'per_request_buffer_limit_bytes' or 'request_body_buffer_limit' can also be adjusted to reduce the likelihood of triggering this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-gcxr-6vrp-wff3 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | < 1.33.12 >= 1.34.0, < 1.34.10 >= 1.35.0, < 1.35.6 >= 1.36.0, < 1.36.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2025 | Initial Analysis | [email protected] |
| Oct 16, 2025 | New CVE Received | [email protected] |