Every CVE Search/ Get API key

CVE-2025-64527

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

6.5 MediumFix available

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.56%Up 0.4 points since Dec 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Record
CVE-2025-64527
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2025-201100 6.5

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Record
EUVD-2025-201100
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mp85-7mrq-r866 6.5

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Summary

Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Details

This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

PoC

  • allow_missing_or_failed or allow_missing is enabled
  • The client send 2 Authorization headers
  • the remote JWKS fetching failed
  • There will be crash

Impact

DoS and Crash

Mitigation

  • Disable the allow_missing_or_failed or allow_missing
Record
GHSA-mp85-7mrq-r866
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 6.5

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Record
CVE-2025-64527
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 6.5

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Record
CVE-2025-64527
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVGHSA-mp85-7mrq-r866 6.5

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Summary

Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Details

This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

PoC

  • allow_missing_or_failed or allow_missing is enabled
  • The client send 2 Authorization headers
  • the remote JWKS fetching failed
  • There will be crash

Impact

DoS and Crash

Mitigation

  • Disable the allow_missing_or_failed or allow_missing
Record
GHSA-mp85-7mrq-r866
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVBIT-envoy-2025-64527 No score

Envoy crashes when JWT authentication is configured with the remote JWKS fetching

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

Record
BIT-envoy-2025-64527
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/envoyproxy/envoy
Go
 1.36.0 to 1.36.2
1.36.3
github.com/envoyproxy/envoy
Go
 1.35.0 to 1.35.6
1.35.7
github.com/envoyproxy/envoy
Go
 1.34.0 to 1.34.10
1.34.11
github.com/envoyproxy/envoy
Go
 through 1.33.12
1.33.13
envoy
Bitnami
 before 1.33.13, 1.34.0 up to 1.34.11, 1.35.0 up to 1.35.7, 1.36.0 up to 1.36.3
1.33.131.34.111.35.71.36.3
github.com/envoyproxy/envoy
Go
 1.36.0 up to 1.36.3
1.36.3
github.com/envoyproxy/envoy
Go
 1.35.0 up to 1.35.7
1.35.7
github.com/envoyproxy/envoy
Go
 1.34.0 up to 1.34.11
1.34.11
github.com/envoyproxy/envoy
Go
 before 1.33.13
1.33.13

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-64527 is a medium vulnerability (CVSS 6.5) in Envoyproxy Envoy, published December 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in github.com/envoyproxy/envoy 1.36.3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open