CVE-2025-64527: Envoy crashes when JWT authentication is configured with the remote JWKS fetching
### Summary Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. ### Details This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives. ### PoC * `allow_missing_or_failed` or `allow_missing` is enabled * The client send 2 Authorization headers * the remote JWKS fetching failed * There will be crash ### Impact DoS and Crash ### Mitigation * Disable the `allow_missing_or_failed` or `allow_missing`
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64527?
CVE-2025-64527 is classified as a critical vulnerability due to its potential to crash Envoy under certain conditions.
How do I fix CVE-2025-64527?
To mitigate CVE-2025-64527, update Envoy to versions beyond 1.36.2 or reconfigure JWT authentication to avoid using multiple tokens in request headers.
What versions of Envoy are affected by CVE-2025-64527?
CVE-2025-64527 affects Envoy versions 1.33.12, 1.34.10, 1.35.6, and 1.36.2 and earlier.
What happens if I don't address CVE-2025-64527?
Neglecting to address CVE-2025-64527 could lead to service disruptions and potential denial of service from crashes when vulnerable configurations are used.
Is CVE-2025-64527 related to JWT authentication?
Yes, CVE-2025-64527 specifically pertains to issues arising from JWT authentication when configured with remote JWKS fetching.