CVE-2025-30157: Envoy crashes when HTTP ext_proc processes local replies
Summary Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.
PoC If both websocket and extproc are enabled, a failed handshake will trigger a local reply, thus extproc will crash.
Mitigation 1. Disable websocket traffic 2. Change the websocket response from backend to always return 101 Switch protocol based on RFC. 3. Apply the patch and the extproc filter will not send the local reply that is generated by Envoy to the extproc server for processing. 4. Apply the patch that the router will cancel the upstream requests when sending a local reply.
Impact Denial of service
Reporter Vasilios Syrakis Fernando Cainelli
Other sources
Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's extproc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/envoyproxy/envoyto a version that resolves this vulnerability.Fixed in 1.33.1 - Upgrade
Upgrade
go/github.com/envoyproxy/envoyto a version that resolves this vulnerability.Fixed in 1.32.4 - Upgrade
Upgrade
go/github.com/envoyproxy/envoyto a version that resolves this vulnerability.Fixed in 1.31.6 - Upgrade
Upgrade
go/github.com/envoyproxy/envoyto a version that resolves this vulnerability.Fixed in 1.30.10 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.33.1 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.32.4 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.31.6 - Upgrade
Upgrade
envoyto a version that resolves this vulnerability.Fixed in 1.30.10 - Configuration
Disable websocket traffic to prevent failed websocket handshakes from triggering local replies that can cause Envoy to crash when ext_proc is enabled.
Envoy websocket websocket traffic = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30157?
CVE-2025-30157 has been classified with a high severity due to the risk of Envoy crashing under certain conditions.
How do I fix CVE-2025-30157?
To fix CVE-2025-30157, upgrade Envoy to version 1.33.1 or higher.
What versions of Envoy are affected by CVE-2025-30157?
CVE-2025-30157 affects Envoy versions prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
What is the nature of the vulnerability described in CVE-2025-30157?
CVE-2025-30157 involves a crashing issue in Envoy's ext_proc HTTP filter when a local reply is sent to an external server.
Is there a workaround for CVE-2025-30157?
Currently, the best practice is to upgrade the affected Envoy versions, as there are no effective workarounds documented.