CVE-2025-62504— Envoy Lua filter use-after-free when oversized rewritten response body causes crash
Quick assessment
Affected
envoyproxy envoy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Envoy是Enphase开源的一款用于连接智能家居设备的网关程序。 Envoy 1.36.2之前版本、1.35.6之前版本、1.34.10之前版本和1.33.12之前版本存在资源管理错误漏洞，该漏洞源于Lua过滤器存在释放后重用，可能导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-62504
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Envoy Lua filter use-after-free when oversized rewritten response body causes crash
Source: CVE Program / CVE List V5
Vulnerability Description
Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Vulnerability Title
Envoy 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Envoy是Enphase开源的一款用于连接智能家居设备的网关程序。 Envoy 1.36.2之前版本、1.35.6之前版本、1.34.10之前版本和1.33.12之前版本存在资源管理错误漏洞，该漏洞源于Lua过滤器存在释放后重用，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| envoyproxy | envoy | >= 1.36.0, <= 1.36.1 | - |
|
II. Public POCs for CVE-2025-62504
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-62504
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: envoy
-
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when us -
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters -
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot seg -
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=ht -
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
Same vendor: envoyproxy
-
CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when us -
CVE-2026-73553
Envoy: RBAC Authorization Bypass via Path Parameters -
CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot seg -
CVE-2026-73546
Envoy: Stored XSS in Admin Stats Interface (/stats?format=ht -
CVE-2026-73512
Envoy: use-after-free in QUIC on internal redirects
Same weakness: CWE-416
V. Comments for CVE-2025-62504
No comments yet