Vulnerability · Published Oct 16, 2025 · Assigned by GitHub_M

CVE-2025-62409Envoy allows large requests and responses to cause TCP connection pool crash

Medium 6.6

In plain English

A medium-severity null pointer dereference in envoy from envoyproxy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)6.6Medium

Exploit odds (30 days)0.5%top 60.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.36.0, < 1.36.1>= 1.35.0, < 1.35.5>= 1.34.0, < 1.34.9< 1.33.10

Weakness: CWE-476 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-pq33-4jxh-hgm3 x_refsource_CONFIRM