CVE-2025-62409

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-29

Assigner: GitHub, Inc.

Description

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-29

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62409

EUVD

EUVD-2025-34820

Affected Vendors & Products

Vendor	Product	Version / Range
envoyproxy	envoy	to 1.33.11 (exc)
envoyproxy	envoy	From 1.34.0 (inc) to 1.34.9 (exc)
envoyproxy	envoy	From 1.35.0 (inc) to 1.35.5 (exc)
envoyproxy	envoy	1.36.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in Envoy, a cloud-native edge and service proxy, occurs when large requests and responses cause TCP connection pool crashes due to flow control management issues. Specifically, it happens when a connection is closing but upstream data is still arriving, leading to a buffer watermark callback nullptr reference. It affects TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. The issue is fixed in versions 1.36.1, 1.35.5, 1.34.9, and 1.33.10.

Impact Analysis

The vulnerability can cause TCP connection pool crashes in Envoy when handling large requests and responses, potentially leading to service disruptions or degraded performance in systems relying on Envoy for proxying TCP and HTTP traffic.

Mitigation Strategies

To mitigate this vulnerability, upgrade Envoy to one of the fixed versions: 1.36.1, 1.35.5, 1.34.9, or 1.33.10.

Hi! I’m here to help you understand CVE-2025-62409. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70