CVE-2025-30157

Published: Mar 21, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.

Affected (4)

Products: Envoyproxy: Envoy

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	Before 1.30.10
Envoyproxy Envoy	From 1.31.0 to 1.31.6
Envoyproxy Envoy	From 1.32.0 to 1.32.4
Envoyproxy Envoy	Version 1.33.0

Related CWEs

Improper Cleanup on Thrown Exception

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

References (3)

https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c

Source: security-advisories@github.com

Patch

https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9

Source: security-advisories@github.com

Vendor Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Vendor Advisory

Timeline

No history available yet.