CVE-2025-64527 Details
Description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
A denial-of-service vulnerability has been identified in Envoy versions through 1.36.2. The issue arises when JWT authentication is used with remote JWKS fetching, and the 'allow_missing_or_failed' option is enabled. If multiple JWT tokens are included in the request headers and the JWKS fetch fails, Envoy crashes. This crash is caused by a re-entry bug in the JwksFetcherImpl component. When the first token's JWKS fetch fails, the onJwksError() callback initiates processing of the second token, which in turn calls fetch() again on the same fetcher object. This process disrupts the state of the second fetch, leading to a crash when the asynchronous HTTP response is received.
Users can mitigate this vulnerability by disabling the 'allow_missing_or_failed' or 'allow_missing' options in the JWT authentication configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| envoyproxy envoy | < 1.33.13 >= 1.34.0, < 1.34.11 >= 1.35.0, < 1.35.7 >= 1.36.0, < 1.36.3 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 5, 2025 | Initial Analysis | [email protected] |
| Dec 3, 2025 | New CVE Received | [email protected] |