CVE-2025-62504

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.2 Envoy versions prior to 1.35.6 Envoy versions prior to 1.34.10 Envoy versions prior to 1.33.12

Description Envoy, an open source edge and service proxy, has a memory safety issue in the Lua filter. When a Lua script modifies a response body to exceed the per connection buffer limit bytes configuration (defaulting to 1MB) during the response phase, Envoy creates a local reply that overwrites original response headers, leading to dangling references and a potential denial of service.

Recommendations Update to Envoy version 1.36.2 Update to Envoy version 1.35.6 Update to Envoy version 1.34.10 Update to Envoy version 1.33.12