CVE-2025-62504: Envoy Lua filter use-after-free when oversized rewritten response body causes crash
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured perconnectionbufferlimitbytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing perconnectionbufferlimitbytes (and for HTTP/2 the initialstreamwindowsize) or increasing perrequestbufferlimitbytes / requestbodybufferlimit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62504?
CVE-2025-62504 is rated with a high severity due to its potential impact on application stability and security.
How do I fix CVE-2025-62504?
To fix CVE-2025-62504, upgrade to Envoy version 1.36.2 or later, or 1.35.6 or later, or 1.34.10 or later, or 1.33.12 or later.
What versions of Envoy are affected by CVE-2025-62504?
Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 are affected by CVE-2025-62504.
What is the nature of the vulnerability in CVE-2025-62504?
CVE-2025-62504 is a use-after-free vulnerability in the Lua filter during response body rewriting.
Can CVE-2025-62504 lead to remote code execution?
While CVE-2025-62504 primarily affects application stability, it could potentially be exploited for further attacks, emphasizing the need for immediate remediation.