{"id":"CVE-2025-30157","aliases":["BIT-envoy-2025-30157","EUVD-2025-7242","GHSA-cf3q-gqg7-3fm9","openSUSE-SU-2025:14938-1"],"status":"published","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00436,"percentile":0.38199,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-460"],"published":"2025-03-21T14:49:18Z","modified":"2026-10-28T10:51:36Z","fixes":[{"ecosystem":"Go","package":"github.com/envoyproxy/envoy","fixed_in":["1.30.10","1.31.6","1.32.4","1.33.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"envoy","fixed_in":["1.30.10","1.31.6","1.32.4","1.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"istioctl","fixed_in":["1.25.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.31.0"},{"fixed":"1.31.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.32.0"},{"fixed":"1.32.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.33.0"},{"fixed":"1.33.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.30.10"},{"introduced":"1.31.0"},{"fixed":"1.31.6"},{"introduced":"1.32.0"},{"fixed":"1.32.4"},{"introduced":"1.33.0"},{"fixed":"1.33.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.30.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.31.0"},{"fixed":"1.31.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.32.0"},{"fixed":"1.32.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/envoyproxy/envoy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.33.0"},{"fixed":"1.33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.1-1.1"}]}]}],"products":[{"vendor":"envoyproxy","product":"envoy"}],"references":[{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9","tags":["x_refsource_CONFIRM","exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30157","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cf3q-gqg7-3fm9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30157.json","tags":["advisory"]},{"url":"https://github.com/envoyproxy/envoy","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GR5REVW6OBLYJVUSSX7MCRA6GRBMLN72/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30157","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-30157","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","status":"published","published":"2025-03-21T14:49:18.113Z","modified":"2025-03-21T15:15:11.034Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-460"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-7242","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","status":"published","published":"2025-03-21T14:49:18Z","modified":"2025-03-21T15:15:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:56.049523Z"}],"ghsa":[{"id":"GHSA-cf3q-gqg7-3fm9","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"### Summary\nEnvoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.\n\n### PoC\nIf both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.\n\n### Mitigation\n1. Disable websocket traffic\n2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.\n3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.\n4. Apply the patch that the router will cancel the upstream requests when sending a local reply.\n\n### Impact\nDenial of service\n\n### Reporter\nVasilios Syrakis\nFernando Cainelli","status":"published","published":"2025-03-21T15:23:50Z","modified":"2025-03-21T15:43:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-460"],"updated_at":"2026-11-02T14:38:35.74197Z"}],"nvd":[{"id":"CVE-2025-30157","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","status":"published","published":"2025-03-21T15:15:43.29Z","modified":"2026-06-17T09:08:15.92Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-460"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-30157","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","status":"published","published":"2025-03-21T14:49:18.113Z","modified":"2026-10-28T10:51:36.047733583Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-460"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-cf3q-gqg7-3fm9","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"### Summary\nEnvoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.\n\n### PoC\nIf both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.\n\n### Mitigation\n1. Disable websocket traffic\n2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.\n3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.\n4. Apply the patch that the router will cancel the upstream requests when sending a local reply.\n\n### Impact\nDenial of service\n\n### Reporter\nVasilios Syrakis\nFernando Cainelli","status":"published","published":"2025-03-21T15:23:50Z","modified":"2026-09-10T03:49:48.46351914Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-460"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"BIT-envoy-2025-30157","title":"Envoy crashes when HTTP ext_proc processes local replies","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.","status":"published","published":"2025-03-25T07:10:09.552Z","modified":"2026-09-08T08:47:31.157090332Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"openSUSE-SU-2025:14938-1","title":"istioctl-1.25.1-1.1 on GA media","description":"These are all security issues fixed in the istioctl-1.25.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-28T00:00:00Z","modified":"2026-02-04T03:14:31.9583Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}