{"id":"CVE-2025-30157","aliases":["BIT-envoy-2025-30157","GHSA-cf3q-gqg7-3fm9"],"url":"https://o3.security/vulnerability/CVE-2025-30157","summary":"Envoy crashes when HTTP ext_proc processes local replies","details":"### Summary\nEnvoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.\n\n### PoC\nIf both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.\n\n### Mitigation\n1. Disable websocket traffic\n2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.\n3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.\n4. Apply the patch that the router will cancel the upstream requests when sending a local reply.\n\n### Impact\nDenial of service\n\n### Reporter\nVasilios Syrakis\nFernando Cainelli","published":"2025-03-21T14:49:18.113Z","modified":"2026-08-12T15:16:23.624854Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/envoyproxy/envoy","fixedVersion":"1.30.10"},{"ecosystem":"Go","name":"github.com/envoyproxy/envoy","fixedVersion":"1.31.6"},{"ecosystem":"Go","name":"github.com/envoyproxy/envoy","fixedVersion":"1.32.4"},{"ecosystem":"Go","name":"github.com/envoyproxy/envoy","fixedVersion":"1.33.1"}],"fix":{"url":"https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c","label":"envoyproxy/envoy@8eda1b8"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30157.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30157"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c"},{"type":"PACKAGE","url":"https://github.com/envoyproxy/envoy"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:16:23.624854Z"}}