Use-After-Free Vulnerability in Envoy Edge and Service Proxy

CVE-2025-62504

What is CVE-2025-62504?

Envoy, an open source edge and service proxy, is affected by a use-after-free vulnerability in the Lua filter. When a Lua script modifies a response body to exceed a set size limit, Envoy can generate a local reply that overrides original response headers. This condition results in dangling references, potentially leading to a denial of service by crashing the proxy. Mitigation involves updating to the fixed versions of Envoy or adjusting buffer limits, although these adjustments do not resolve the fundamental memory safety issue.

References