Envoy TcpStatsSink Heap Buffer Overflow Vulnerability (CVE-2025-48706) Advisory and Fix

Vulnerability Overview Vulnerability Name: Envoy Heap Buffer Overflow in TcpStatsSink Vulnerability Type: Heap Buffer Overflow / Memory Corruption Severity: High Description: A vulnerability exists in Envoy's TCP StatsD receiver (TcpStatsSink), where the thread-local flush buffer can be overflowed by excessively long statistics names (e.g., >16KB). When formatting, TcpStatsSink retains a contiguous memory slice of 16KB (FLUSH_SLICE_SIZE_BYTES). If a single metric exceeds the remaining capacity, the flusher initiates a buffer rotation but incorrectly proceeds to allocate another fixed 16KB slice. If an attacker can trigger a static name exceeding 16KB (for example, by sending an HTTP or gRPC request with an extremely long request path), and this path is recorded by the filter with set to true, the flusher will attempt to copy the name using beyond the boundaries of the allocated heap buffer. This results in a heap overflow, potentially causing immediate denial of service (process crash) or, potentially, remote code execution (RCE). Impact Scope Affected Versions: >=v1.34, <1.39 Fixed Versions: 1.35.13, 1.36.9, 1.37.5, 1.38.3 Affected Component: Envoy Proxy CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2025-48706 Weakness: CWE-120 Remediation Patch The issue exists in the latest Envoy branch and all supported release branches. Workaround Users can mitigate this vulnerability through the following actions: 1. Switch to UDP StatsD: Configure to use UDP instead of TCP. The UDP stats flusher path uses safe dynamic buffer appending and is not affected by this heap buffer overflow. 2. Disable Method-Based Statistics: Disable on and avoid dynamic path generation or client-controlled metric generation. References GitHub Repository: github.com/envoyproxy/envoy Security Advisory: envoyproxy/envoy Public --- Note: Specific POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Envoy TcpStatsSink Heap Buffer Overflow Vulnerability (CVE-2025-48706) Advisory and Fix

More from this source