CVE-2025-54588: Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults
Summary
A use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.
Details
The vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:
1. Dynamic Forwarding Filter is enabled. 2. envoy.reloadablefeatures.dfpclusterresolveshosts runtime flag is enabled. 3. The Host header is modified between the Dynamic Forwarding Filter and Router filters.
Impact
Denial of service due to abnormal process termination.
Attack vector(s) Request to Envoy configured as indicated above.
Patches Users should upgrade to v1.35.1 or v1.34.5.
Workaround Set the envoy.reloadablefeatures.dfpclusterresolveshosts runtime flag to false.
Detection Abnormal process termination with the Envoy::Event::DispatcherImpl::runPostCallbacks() frame in the call stack.
Credits Rohit Agrawal (agrawroh) (rohit.agrawal@databricks.com)
Other sources
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the envoy.reloadablefeatures.dfpclusterresolveshosts runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadablefeatures.dfpclusterresolveshosts runtime flag to false.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54588?
CVE-2025-54588 is classified as a high-severity vulnerability due to its potential to cause abnormal termination of processes.
What versions of Envoy are affected by CVE-2025-54588?
CVE-2025-54588 affects Envoy versions 1.34.0 through 1.34.4 and also 1.35.0.
How do I fix CVE-2025-54588?
To remediate CVE-2025-54588, upgrade to Envoy version 1.34.5 or 1.35.1 or later.
What is a use-after-free vulnerability in the context of CVE-2025-54588?
A use-after-free vulnerability, like CVE-2025-54588, occurs when a program continues to use a memory resource after it has been freed, leading to potential crashes or exploitation.
What impact does CVE-2025-54588 have on system stability?
CVE-2025-54588 can lead to unexpected crashes and system instability due to the abnormal termination of processes related to the DNS cache.