SB2025120345 - Multiple vulnerabilities in Envoy

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper certificate validation (CVE-ID: CVE-2025-66220)

The vulnerability allows a remote attacker to impersonate other users.

The vulnerability exists due to incorrect processing of client certificates with an embedded null byte (\0) inside an OTHERNAME SAN value. A remote attacker who can obtain a trusted client certificate can impersonate a matched identity and bypass TLS-based authorization checks. 

2) State Issues (CVE-ID: CVE-2025-64763)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a state issue related to forwarding of early CONNECT data in TCP proxy mode. A remote attacker can trigger de-synchronization of CONNECT tunnel state if a forwarding proxy upstream from Envoy responds with a non 2xx status and gain access to sensitive information.

3) Input validation error (CVE-ID: CVE-2025-64527)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the JwksFetcherImpl. A remote user can send a specially crafted request to the application and perform a denial of service (DoS) attack.

The vulnerability requires that JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Remediation

Install update from vendor's website.

References

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-rj35-4m94-77jh
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866