UpHeron
All vulnerabilities

Servers and applications

CVE-2025-62504

Lua modified large enough response body will cause Envoy to crash

Severity
High 7.5
Published
16 Oct 2025
Last changed
9 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.12, 1.34.10, 1.35.6, 1.36.2
Also known as
GHSA-gcxr-6vrp-wff3
Sources
NVD, Project advisories (GitHub)

Description

Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.33.12
  • From 1.34.0 before 1.34.10
  • From 1.35.0 before 1.35.6
  • From 1.36.0 before 1.36.2
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.33.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-62504
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62504
  • GitHub Advisory Database https://github.com/advisories/GHSA-gcxr-6vrp-wff3
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-gcxr-6vrp-wff3