Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M

CVE-2025-64527Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Medium 6.5

In plain English

A medium-severity null pointer dereference in envoy from envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/envoyproxy/envoy	1.36.3	GHSA-mp85-7mrq-r866
Go	github.com/envoyproxy/envoy	1.35.7	GHSA-mp85-7mrq-r866
Go	github.com/envoyproxy/envoy	1.34.11	GHSA-mp85-7mrq-r866
Go	github.com/envoyproxy/envoy	1.33.13	GHSA-mp85-7mrq-r866

Affected products (as reported)

Vendor	Product	Versions
envoyproxy	envoy	>= 1.36.0, <= 1.36.2>= 1.35.0, <= 1.35.6>= 1.34.0, <= 1.34.10<= 1.33.12

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866 x_refsource_CONFIRM