Crash Vulnerability in Envoy Edge Proxy Affected by JWT Authentication Configuration
CVE-2025-64527

6.5MEDIUM

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
3 December 2025

What is CVE-2025-64527?

A vulnerability exists in Envoy Proxy that can lead to a service crash when JWT authentication is utilized with remote JWKS fetching. Specifically, if multiple JWT tokens are present in the request headers and allow_missing_or_failed is enabled, a failure during JWKS fetch can trigger a series of processing errors. The issue originates from a re-entry bug in the JwksFetcherImpl, which mishandles the state of the fetch operation when the initial token’s JWKS fetch fails. This mismanagement can lead to significant service interruptions, impacting stability for users relying on this powerful edge proxy technology.

Affected Version(s)

envoy >= 1.36.0, <= 1.36.2 <= 1.36.0, 1.36.2

envoy >= 1.35.0, <= 1.35.6 <= 1.35.0, 1.35.6

envoy >= 1.34.0, <= 1.34.10 <= 1.34.0, 1.34.10

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.