GHSA-cf3q-gqg7-3fm9
Envoy crashes when HTTP ext_proc processes local replies
At a glance
- Published
- Updated
- CVE
- CVE-2025-30157
- Aliases
- BIT-envoy-2025-30157
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
### Summary Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy. ### PoC If both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash. ### Mitigation 1. Disable websocket traffic 2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC. 3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing. 4. Apply the patch that the router will cancel the upstream requests when sending a local reply. ### Impact Denial of service ### Reporter Vasilios Syrakis Fernando Cainelli
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/envoyproxy/envoy | introduced 0, fixed 1.30.10 |
| Go · github.com/envoyproxy/envoy | introduced 1.31.0, fixed 1.31.6 |
| Go · github.com/envoyproxy/envoy | introduced 1.32.0, fixed 1.32.4 |
| Go · github.com/envoyproxy/envoy | introduced 1.33.0, fixed 1.33.1 |
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9 WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-30157 ADVISORY
- https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c WEB
- https://github.com/envoyproxy/envoy PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |