UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54588

Use after free in DNS cache

Severity
High 7.5
Published
2 Sept 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.34.5
Also known as
GHSA-g9vw-6pvx-7gmw
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.34.0 before 1.34.5
  • Version 1.35.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Version 1.34.0-4
  • Version 1.35.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54588
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54588
  • GitHub Advisory Database https://github.com/advisories/GHSA-g9vw-6pvx-7gmw
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw