UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62409

Large requests and responses can cause TCP connection pool crash

Severity
Medium 6.6
Published
15 Oct 2025
Last changed
9 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.11, 1.34.9, 1.35.5
Also known as
GHSA-pq33-4jxh-hgm3
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.33.11
  • From 1.34.0 before 1.34.9
  • From 1.35.0 before 1.35.5
  • Version 1.36.0
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.33.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62409
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62409
  • GitHub Advisory Database https://github.com/advisories/GHSA-pq33-4jxh-hgm3
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3