CVE-2025-64527: Envoy crashes when JWT authentication is configured with the remote JWKS fetching
Summary Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allowmissingorfailed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.
Details This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object.
The original callback's reset() then clears the second fetch's state (receiver and request) which causes a crash when the async HTTP response arrives.
PoC allowmissingorfailed or allowmissing is enabled The client send 2 Authorization headers the remote JWKS fetching failed There will be crash
Impact DoS and Crash
Mitigation Disable the allowmissingorfailed or allowmissing
Other sources
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allowmissingorfailed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver and request) which causes a crash when the async HTTP response arrives.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64527?
CVE-2025-64527 is classified as a critical vulnerability due to its potential to crash Envoy under certain conditions.
How do I fix CVE-2025-64527?
To mitigate CVE-2025-64527, update Envoy to versions beyond 1.36.2 or reconfigure JWT authentication to avoid using multiple tokens in request headers.
What versions of Envoy are affected by CVE-2025-64527?
CVE-2025-64527 affects Envoy versions 1.33.12, 1.34.10, 1.35.6, and 1.36.2 and earlier.
What happens if I don't address CVE-2025-64527?
Neglecting to address CVE-2025-64527 could lead to service disruptions and potential denial of service from crashes when vulnerable configurations are used.
Is CVE-2025-64527 related to JWT authentication?
Yes, CVE-2025-64527 specifically pertains to issues arising from JWT authentication when configured with remote JWKS fetching.