Envoy

### Impact Vulnerability Type: Heap Out-of-Bounds Write / Memory Corruption Severity: High Description: A vulnerability exists in Envoy's TCP StatsD sink (TcpStatsdSink), where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16KiB). During formatting, TcpStatsdSink reserves a single contiguous memory slice of 16KiB (FLUSH_SLICE_SIZE_BYTES).

### Summary Abnormal process termination in DNS UDP filter when resolving a DNS query containing a name with the length of 255 octets. ### Details In cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long can complete successfully, a query with such name will result in abnormal process termination.

### Summary _Short summary of the problem. Make the impact and severity as clear as possible._ The **HTTP OAuth2 filter** (`envoy.filters.http.oauth2`) can leave an **in-flight async token exchange** attached to a **downstream stream** that has already been torn down.

### Summary Improper Certificate Validation (Embedded NUL Truncation) in Envoy Default TLS Certificate Validator. Severity: MEDIUM (Host Authentication Bypass / MITM) Affected Code: DefaultCertValidator::verifySubjectAltName (source/common/tls/cert_validator/default_validator.cc:399) ### Details Envoy's standard TLS component validates the Subject Alternative Name (SAN) of certificates to ensure it matches the target upstream host.

### Summary PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in the header. This can result in smuggled bytes on the upstream request.

### Summary The `envoy.filters.http.grpc_stats` filter crashes (null pointer dereference / segfault) when a Connect protocol request (`Content-Type: application/connect+proto` or `application/connect+json`) hits a direct_response route. A single unauthenticated HTTP request crashes the Envoy process. No special payload, gRPC client, or protobuf framing is required just the right Content-Type header hitting direct_response route.

## Summary The OAuth2 HTTP filter's `encrypt()`/`decrypt()` functions use AES-256-CBC without an authentication tag (no HMAC, no AEAD). The `/callback` endpoint returns HTTP 302 on successful decryption and HTTP 401 on padding failure, creating a padding oracle. An attacker who obtains the encrypted `CodeVerifier` cookie can recover the plaintext PKCE `code_verifier` in ~6,200 requests (~100 seconds), then exchange it with a stolen authorization code to obtain the victim's access token.

## Summary Envoy is an open-source edge and service proxy designed for cloud-native applications. The router filter contains a null pointer dereference vulnerability when handling HTTP 303 (See Other) internal redirects for body-less non-GET/HEAD requests.

### Summary Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted `ProcessingResponse` messages. This can occur when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message. ### Details Envoy crashes when call: callbacks_.onReceiveMessageRaw() in the function AsyncStreamImpl::onData().

# ext_authz Use-After-Free during Stream Teardown with Per-Route Overrides ## Vulnerability Details **Vulnerability Type:** Use-After-Free (UAF) **Component:** `ext_authz` filter **Severity:** HIGH (Data-plane crash/DoS) ### Description A Use-After-Free (UAF) vulnerability leading to a sudden segmentation fault exists in Envoy's `ext_authz` HTTP filter when processing per-route authorization overrides concurrently with rapid downstream client disconnects.

### Summary Calling `Utility::getAddressWithPort` with a scoped IPv6 addresses causes a crash. This utility is called in the data plane from the original_src filter and the dns filter. ### Details The crashing function is `Utility::getAddressWithPort`. The crash occurs if a string containing a scoped IPv6 address is passed to this function. This vulnerability affects: 1.

**Note:** This vulnerability was originally reported to the Google OSS VRP (Issue ID: [477542544](https://issuetracker.google.com/issues/477542544)). The Google Security Team requested that I coordinate directly with the Envoy maintainers for triage and remediation. I am submitting this report here to facilitate that process. **Technical Details** I have identified a logic vulnerability in Envoy's HTTP connection manager (`FilterManager`) that allows for **Zombie Stream Filter Execution**.

### Summary An off-by-one write in Envoy::JsonEscaper::escapeString() can corrupt std::string null-termination, causing undefined behavior and potentially leading to crashes or out-of-bounds reads when the resulting string is later treated as a C-string. ### Details The bug is in the control-character escaping path in source/common/common/ json_escape_string.h:67.

### Summary At the rate limit filter, if we enabled the response phase limit with `apply_on_stream_done` in the rate limit configuration and the response phase limit request fails directly, it may crash Envoy. ### Details When both the request phase limit and response phase limit are enabled, the safe gRPC client instance will be re-used for both the request phase request and response phase request.

### Summary A heap use-after-free vulnerability has been identified in c-ares (`<1.34.6`). For more information see [CVE-2025-62408](https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5). The issue occurs during the `ares_getaddrinfo` query lifecycle when processing a specific sequence of DNS responses. If a trusted adjacent DNS resolver returns an `NXDOMAIN` response followed by a connection refusal during a search domain retry, it triggers a memory corruption error.

### Summary Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. ### Details This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

### Summary Envoy’s mTLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte (\0) inside an `OTHERNAME` SAN value as valid matches. ### Details This occurs when the SAN is encoded as a `BMPSTRING` or `UNIVERSALSTRING`, and its UTF-8 conversion result is truncated at the first null byte during string assignment. As a result, `"victim\0evil"` may match an exact: `"victim"` rule and be accepted by Envoy.

### Summary When Lua directly returns an oversized response body exceeding the `per_connection_buffer_limit_bytes` (default 1MB), Envoy will crash directly. ### Details A Use-After-Free vulnerability exists in the Envoy proxy's Lua filter. The vulnerability is triggered when a Lua script, executing during the response phase, rewrites a response body to a size that exceeds the configured buffer watermark, resulting in a local reply.

### Summary Insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with `__Secure-` or `__Host-` prefixed cookie names, the filter fails to append the required `Secure` attribute to the `Set-Cookie` header during deletion. Modern browsers ignore this invalid request, causing the session cookie to persist. This allows a user to remain logged in after they believe they have logged out, creating a session hijacking risk on shared computers.

### Summary Envoy's URI template matcher does not match URI paths containing the `*` character. ### Affected Components Envoy's [URI template matcher](https://www.envoyproxy.io/docs/envoy/v1.34.0/api-v3/extensions/path/match/uri_template/v3/uri_template_match.proto.html) and Envoy's [HTTP RBAC extension](https://www.envoyproxy.io/docs/envoy/v1.34.0/api-v3/config/rbac/v3/rbac.proto) when configured with the `uri_template` permissions.

### Summary Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy. ### PoC If both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash. ### Mitigation 1. Disable websocket traffic 2.

### Details When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This CVE will validate all additional and original addresses are IP addresses.

### Summary Envoy will crash when the HTTP async client is handling `sendLocalReply` under some circumstance, e.g., WebSocket upgrade, and requests mirroring. ### Details The HTTP async client can crash during the `sendLocalReply()` in HTTP async client. One reason is HTTP async client is duplicating the status code, and another is the router is destroyed at the destructor of the async stream, while the stream is deferred deleted at first.

### Summary JWT filter will lead to an Envoy crash when clear route cache with remote JWKs. ### Details and PoC Fix an issue in JWT filter in the following case: * remote JWKs are used, which requires async header processing; * `clear_route_cache` is enabled on the provider; * header operations are enabled in JWT filter, e.g. header to claims feature; * the routing table is configured in a way that the JWT header operations modify requests to not match any route.

### Summary A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. ### Details The default behavior for handling internal addresses in Envoy has been changed.

### Summary A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. ### PoC In our default access log format, the primary arbitrary input fields are headers. `REQUESTED_SERVER_NAME` also can take arbitrary inputs and has no validation in Envoy at all (despite the RFC being pretty strict).

### Summary Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. ### Affected Components Envoy request routing table. ### Details Memory allocated for holding attribute values is freed after configuration was parsed. During request processing Envoy will attempt to copy content of de-allocated memory into request cookie header.