UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30157

Envoy crashes when HTTP ext_proc processes local replies

Severity
High 7.5
Published
20 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.30.10, 1.31.6, 1.32.4
Also known as
GHSA-cf3q-gqg7-3fm9
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.30.10
  • From 1.31.0 before 1.31.6
  • From 1.32.0 before 1.32.4
  • Version 1.33.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.30.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30157
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30157
  • GitHub Advisory Database https://github.com/advisories/GHSA-cf3q-gqg7-3fm9
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9