CVE-2025-64527Medium· 6.5▾ SunlitEnvoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.
envoy < 1.33.13envoy >= 1.34.0, < 1.34.11envoy >= 1.35.0, < 1.35.7envoy >= 1.36.0, < 1.36.3Upgrade past the affected range:
envoy 1.36.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48521Medium· 5.9Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73547High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2025-66220Medium· 5.0Envoy is a high-performance edge/middle/service proxy
CVE-2026-73551Medium· 5.3Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73553High· 7.5Envoy is an open source edge and service proxy designed for cloud-native applications
CVE-2026-73511Medium· 5.3Envoy is an open source edge and service proxy designed for cloud-native applications