CVE-2025-62409

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3	Vendor Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy::::::::
	cpe:2.3:a:envoyproxy:envoy:1.36.0:::::::*

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Envoy es un proxy de borde y de servicio nativo de la nube y de código abierto. Antes de 1.36.1, 1.35.5, 1.34.9 y 1.33.10, las solicitudes y respuestas grandes pueden potencialmente desencadenar fallos del pool de conexiones TCP debido a la gestión del control de flujo en Envoy. Sucederá cuando la conexión se esté cerrando pero los datos de upstream sigan llegando, lo que resulta en una referencia nullptr de devolución de llamada de marca de agua de búfer. La vulnerabilidad afecta al proxy TCP y a los casos de uso mixto de HTTP 1 y 2 basados en ALPN. Esta vulnerabilidad está corregida en 1.36.1, 1.35.5, 1.34.9 y 1.33.10.

Information

Published : 2025-10-16 18:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-62409

Mitre link : CVE-2025-62409

CVE.ORG link : CVE-2025-62409

JSON object : View

Products Affected

envoyproxy

envoy

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-62409", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62409", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T18:27:13.901972Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "envoyproxy", "product": "envoy", "versions": [{"status": "affected", "version": ">= 1.36.0, < 1.36.1"}, {"status": "affected", "version": ">= 1.35.0, < 1.35.5"}, {"status": "affected", "version": ">= 1.34.0, < 1.34.9"}, {"status": "affected", "version": "< 1.33.10"}]}]}], "published": "2025-10-16T18:15:39.583", "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3", "tags": ["Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10."}, {"lang": "es", "value": "Envoy es un proxy de borde y de servicio nativo de la nube y de c\u00f3digo abierto. Antes de 1.36.1, 1.35.5, 1.34.9 y 1.33.10, las solicitudes y respuestas grandes pueden potencialmente desencadenar fallos del pool de conexiones TCP debido a la gesti\u00f3n del control de flujo en Envoy. Suceder\u00e1 cuando la conexi\u00f3n se est\u00e9 cerrando pero los datos de upstream sigan llegando, lo que resulta en una referencia nullptr de devoluci\u00f3n de llamada de marca de agua de b\u00fafer. La vulnerabilidad afecta al proxy TCP y a los casos de uso mixto de HTTP 1 y 2 basados en ALPN. Esta vulnerabilidad est\u00e1 corregida en 1.36.1, 1.35.5, 1.34.9 y 1.33.10."}], "lastModified": "2026-10-09T10:10:00.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5DCDFD-15E5-41FF-B3C8-65B562364BBB", "versionEndExcluding": "1.33.11"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "451649E4-695B-43C3-BC66-62BDC52B4D34", "versionEndExcluding": "1.34.9", "versionStartIncluding": "1.34.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F77D99D7-F2B2-438A-921B-BDBD695FDF0E", "versionEndExcluding": "1.35.5", "versionStartIncluding": "1.35.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.36.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E599909-9956-454A-B1A3-E550188B27CD"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}