UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64527

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Severity
Medium 6.5
Published
3 Dec 2025
Last changed
25 Sept 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.33.13, 1.34.11, 1.35.7, 1.36.3
Also known as
GHSA-mp85-7mrq-r866
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.33.13
  • From 1.34.0 before 1.34.11
  • From 1.35.0 before 1.35.7
  • From 1.36.0 before 1.36.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.33.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64527
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64527
  • GitHub Advisory Database https://github.com/advisories/GHSA-mp85-7mrq-r866
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866