Service Proxy Vulnerability in Envoy by Envoy Proxy
CVE-2025-30157

7.5HIGH

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
21 March 2025

What is CVE-2025-30157?

Envoy is a high-performance cloud-native service proxy that has a vulnerability in its ext_proc HTTP filter. This issue can lead to crashes when a local reply is sent to an external server, particularly if a websocket handshake fails. During this event, the filter does not properly manage its lifecycle, which causes Envoy to become unstable and crash. This flaw affects versions of Envoy prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, with patches available in the later releases.

Affected Version(s)

envoy >= 1.33.0, < 1.33.1 < 1.33.0, 1.33.1

envoy >= 1.32.0, < 1.32.4 < 1.32.0, 1.32.4

envoy >= 1.31.0, < 1.31.6 < 1.31.0, 1.31.6

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba86...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.