CVE-2025-64527
Last modified
CVE-2025-64527 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Envoyproxy | Envoy | < 1.33.13 |
| Envoyproxy | Envoy | >= 1.34.0, < 1.34.11 |
| Envoyproxy | Envoy | >= 1.35.0, < 1.35.7 |
| Envoyproxy | Envoy | >= 1.36.0, < 1.36.3 |
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-64527?
How severe is CVE-2025-64527?
How do I fix CVE-2025-64527?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-64521authentik is an open-source Identity Provider. Prior to vers…4.8
- CVE-2025-64522Soft Serve is a self-hostable Git server for the command lin…7.6
- CVE-2025-64523File Browser provides a file managing interface within a spe…8.8
- CVE-2025-64524cups-filters contains backends, filters, and other software …5.5
- CVE-2025-64525Astro is a web framework. In Astro versions 2.16.0 up to but…6.5
- CVE-2025-64526Strapi is an open source headless content management system.…5.3
- CVE-2025-64528Discourse is an open source discussion platform. Prior to ve…5.3
- CVE-2025-64529SpiceDB is an open source database system for creating and m…6.5
- CVE-2025-6453A vulnerability classified as critical has been found in diy…4.3
- CVE-2025-64530Apollo Federation is an architecture for declaratively compo…7.5
- CVE-2025-64531Substance3D - Stager versions 3.1.5 and earlier are affected…7.8
- CVE-2025-64537Adobe Experience Manager versions 6.5.23 and earlier are aff…9.3
Are you affected by CVE-2025-64527?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST