Vulnerability-Lookup

CVE-2025-54588 (GCVE-0-2025-54588)

Vulnerability from cvelistv5 – Published: 2025-09-02 23:39 – Updated: 2025-09-03 20:27

Title

Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Summary

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-03 20:26 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/releases/tag/…	x_refsource_MISC
https://github.com/envoyproxy/envoy/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
envoyproxy	envoy	Affected: >= 1.34.0, < 1.34.5 Affected: >= 1.35.0, < 1.35.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T20:26:55.680372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T20:27:46.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.34.0, \u003c 1.34.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.35.0, \u003c 1.35.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy\u0027s Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-02T23:39:07.429Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5"
        },
        {
          "name": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1"
        }
      ],
      "source": {
        "advisory": "GHSA-g9vw-6pvx-7gmw",
        "discovery": "UNKNOWN"
      },
      "title": "Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54588",
    "datePublished": "2025-09-02T23:39:07.429Z",
    "dateReserved": "2025-07-25T16:19:16.094Z",
    "dateUpdated": "2025-09-03T20:27:46.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-54588",
      "date": "2026-09-17",
      "epss": "0.00475",
      "percentile": "0.40053"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-54588\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-09-03T00:15:30.067\",\"lastModified\":\"2026-06-17T09:40:21.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy\u0027s Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"envoyproxy\",\"product\":\"envoy\",\"versions\":[{\"version\":\"\u003e= 1.34.0, \u003c 1.34.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 1.35.0, \u003c 1.35.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-03T20:26:55.680372Z\",\"id\":\"CVE-2025-54588\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.34.0\",\"versionEndExcluding\":\"1.34.5\",\"matchCriteriaId\":\"1F1AA6D9-25A4-4950-A81E-FB151E6BF8C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:1.35.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2645CD2A-8C59-4ED4-AC88-5BE9660B6D08\"}]}]}],\"references\":[{\"url\":\"https://github.com/envoyproxy/envoy/releases/tag/v1.34.5\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/envoyproxy/envoy/releases/tag/v1.35.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-28T07:05:26+00:00",
      "cve": "CVE-2025-54588",
      "id": "CVE-2025-54588",
      "initial_release_date": "2025-09-03T00:00:00+00:00",
      "product_status:fixed": "8",
      "product_status:known_not_affected": "49",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "envoyproxy/envoy: Use after free in DNS cache",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-54588.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-09-05T23:22:26Z",
      "cve": "CVE-2025-54588",
      "id": "CVE-2025-54588",
      "initial_release_date": "2025-09-05T23:22:26Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-54588",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-54588.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-54588\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-03T20:26:55.680372Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-03T20:27:35.961Z\"}}], \"cna\": {\"title\": \"Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults\", \"source\": {\"advisory\": \"GHSA-g9vw-6pvx-7gmw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"envoyproxy\", \"product\": \"envoy\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.34.0, \u003c 1.34.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.35.0, \u003c 1.35.1\"}]}], \"references\": [{\"url\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw\", \"name\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/envoyproxy/envoy/releases/tag/v1.34.5\", \"name\": \"https://github.com/envoyproxy/envoy/releases/tag/v1.34.5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/envoyproxy/envoy/releases/tag/v1.35.1\", \"name\": \"https://github.com/envoyproxy/envoy/releases/tag/v1.35.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy\u0027s Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416: Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-09-02T23:39:07.429Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-54588\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-03T20:27:46.781Z\", \"dateReserved\": \"2025-07-25T16:19:16.094Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-09-02T23:39:07.429Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

bit-envoy-2025-54588

Vulnerability from bitnami_vulndb

Published

2025-09-04 08:40

Modified

2026-09-08 08:34

Summary

Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Details

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "envoy",
        "purl": "pkg:bitnami/envoy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.34.0"
            },
            {
              "fixed": "1.34.5"
            },
            {
              "introduced": "1.35.0"
            },
            {
              "fixed": "1.35.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54588"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
      "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:go:*:*"
    ],
    "severity": "High"
  },
  "details": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy\u0027s Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.",
  "id": "BIT-envoy-2025-54588",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2025-09-04T08:40:05.078Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54588"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults"
}

FKIE_CVE-2025-54588

Vulnerability from fkie_nvd - Published: 2025-09-03 00:15 - Updated: 2026-06-17 09:40

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/envoyproxy/envoy/releases/tag/v1.34.5	Release Notes
security-advisories@github.com	https://github.com/envoyproxy/envoy/releases/tag/v1.35.1	Release Notes
security-advisories@github.com	https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw	Patch, Vendor Advisory

Impacted products

	Vendor	Product	Version
	envoyproxy	envoy	*
	envoyproxy	envoy	1.35.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.34.0, \u003c 1.34.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.35.0, \u003c 1.35.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F1AA6D9-25A4-4950-A81E-FB151E6BF8C5",
              "versionEndExcluding": "1.34.5",
              "versionStartIncluding": "1.34.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.35.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2645CD2A-8C59-4ED4-AC88-5BE9660B6D08",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy\u0027s Dynamic Forward Proxy implementation, occurring when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur when the following conditions are met: dynamic Forwarding Filter is enabled, the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled, and the Host header is modified between the Dynamic Forwarding Filter and Router filters. This issue is resolved in versions 1.34.5 and 1.35.1. To work around this issue, set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false."
    }
  ],
  "id": "CVE-2025-54588",
  "lastModified": "2026-06-17T09:40:21.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54588",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-09-03T20:26:55.680372Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-09-03T00:15:30.067",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-G9VW-6PVX-7GMW

Vulnerability from github – Published: 2025-09-15 16:46 – Updated: 2025-09-15 16:46

Summary

Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Details

Summary

A use-after-free (UAF) vulnerability in Envoy's DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.

Details

The vulnerability exists in Envoy's Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:

Dynamic Forwarding Filter is enabled.
envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag is enabled.
The Host header is modified between the Dynamic Forwarding Filter and Router filters.

Impact

Denial of service due to abnormal process termination.

Attack vector(s)

Request to Envoy configured as indicated above.

Patches

Users should upgrade to v1.35.1 or v1.34.5.

Workaround

Set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false.

Detection

Abnormal process termination with the Envoy::Event::DispatcherImpl::runPostCallbacks() frame in the call stack.

Credits

Rohit Agrawal (agrawroh) (rohit.agrawal@databricks.com)

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/envoy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.35.0"
            },
            {
              "fixed": "1.35.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.35.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/envoyproxy/envoy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.34.0"
            },
            {
              "fixed": "1.34.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T16:46:37Z",
    "nvd_published_at": "2025-09-03T00:15:30Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA use-after-free (UAF) vulnerability in Envoy\u0027s DNS cache causes abnormal process termination. Envoy may reallocate memory when processing a pending DNS resolution, causing list iterator to reference freed memory.\n\n### Details\n\nThe vulnerability exists in Envoy\u0027s Dynamic Forward Proxy implementation starting from version v1.34.0. The issue occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This condition may occur in the following configuration:\n\n1. Dynamic Forwarding Filter is enabled.\n2. `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag is enabled.\n3. The Host header is modified between the Dynamic Forwarding Filter and Router filters.\n\n### Impact\n\nDenial of service due to abnormal process termination.\n\n### Attack vector(s)\nRequest to Envoy configured as indicated above.\n\n### Patches\nUsers should upgrade to v1.35.1 or v1.34.5. \n\n### Workaround\nSet the `envoy.reloadable_features.dfp_cluster_resolves_hosts` runtime flag to `false`.\n\n### Detection\nAbnormal process termination with the `Envoy::Event::DispatcherImpl::runPostCallbacks()` frame in the call stack.\n\n### Credits\nRohit Agrawal ([agrawroh](https://github.com/agrawroh)) ([rohit.agrawal@databricks.com](mailto:rohit.agrawal@databricks.com))",
  "id": "GHSA-g9vw-6pvx-7gmw",
  "modified": "2025-09-15T16:46:37Z",
  "published": "2025-09-15T16:46:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54588"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/envoyproxy/envoy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.34.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/envoyproxy/envoy/releases/tag/v1.35.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults"
}

RHSA-2025:16040

Vulnerability from csaf_redhat - Published: 2025-09-17 06:34 - Updated: 2026-09-05 21:42

Summary

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.5

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-54588.

CVE-2025-54588

A memory corruption flaw was discovered in how the Envoy proxy handles its DNS cache. This issue could allow a specific sequence of DNS lookups to cause the Envoy process to crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Fixed: 4 products Known not affected: 21 products

https://access.redhat.com/errata/RHSA-2025:16040

Open the full advisory

RHSA-2025:16044

Vulnerability from csaf_redhat - Published: 2025-09-17 07:00 - Updated: 2026-09-05 21:42

Summary

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.2

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2025-54588.

CVE-2025-54588

A memory corruption flaw was discovered in how the Envoy proxy handles its DNS cache. This issue could allow a specific sequence of DNS lookups to cause the Envoy process to crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Fixed: 4 products Known not affected: 21 products

https://access.redhat.com/errata/RHSA-2025:16044

Open the full advisory

WID-SEC-W-2025-1945

Vulnerability from csaf_certbund - Published: 2025-09-02 22:00 - Updated: 2025-09-02 22:00

Summary

Google Cloud Platform (Service Mesh): Schwachstelle ermöglicht Denial of Service

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2025-54588.

CVE-2025-54588

Known affected: 1 product

Open the full advisory

WID-SEC-W-2025-2085

Vulnerability from csaf_certbund - Published: 2025-09-17 22:00 - Updated: 2026-01-05 23:00

Summary

Red Hat OpenShift Service Mesh: Mehrere Schwachstellen

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2025-54588.

CVE-2025-54588

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-54588 (GCVE-0-2025-54588)

bit-envoy-2025-54588

Vulnerability from bitnami_vulndb

FKIE_CVE-2025-54588

GHSA-G9VW-6PVX-7GMW

Summary

Details

Impact

Attack vector(s)

Patches

Workaround

Detection

Credits

RHSA-2025:16040

RHSA-2025:16044

WID-SEC-W-2025-1945

WID-SEC-W-2025-2085

Tags

Sightings

Nomenclature

Related by attack behaviour