CVE-2025-62504: Envoy Lua filter use-after-free when oversized rewritten response body causes crash
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62504?
CVE-2025-62504 is rated with a high severity due to its potential impact on application stability and security.
How do I fix CVE-2025-62504?
To fix CVE-2025-62504, upgrade to Envoy version 1.36.2 or later, or 1.35.6 or later, or 1.34.10 or later, or 1.33.12 or later.
What versions of Envoy are affected by CVE-2025-62504?
Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 are affected by CVE-2025-62504.
What is the nature of the vulnerability in CVE-2025-62504?
CVE-2025-62504 is a use-after-free vulnerability in the Lua filter during response body rewriting.
Can CVE-2025-62504 lead to remote code execution?
While CVE-2025-62504 primarily affects application stability, it could potentially be exploited for further attacks, emphasizing the need for immediate remediation.