{"id":"GHSA-cf3q-gqg7-3fm9","summary":"Envoy crashes when HTTP ext_proc processes local replies","details":"### Summary\nEnvoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.\n\n### PoC\nIf both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.\n\n### Mitigation\n1. Disable websocket traffic\n2. Change the websocket response from backend to always return `101 Switch protocol` based on RFC.\n3. Apply the patch and the ext_proc filter will not send the local reply that is generated by Envoy to the ext_proc server for processing.\n4. Apply the patch that the router will cancel the upstream requests when sending a local reply.\n\n### Impact\nDenial of service\n\n### Reporter\nVasilios Syrakis\nFernando Cainelli","aliases":["BIT-envoy-2025-30157","CVE-2025-30157"],"modified":"2026-08-24T00:36:01.795924482Z","published":"2025-03-21T15:23:50Z","database_specific":{"github_reviewed_at":"2025-03-21T15:23:50Z","nvd_published_at":"2025-03-21T15:15:43Z","cwe_ids":["CWE-460"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30157"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c"},{"type":"PACKAGE","url":"https://github.com/envoyproxy/envoy"}],"affected":[{"package":{"name":"github.com/envoyproxy/envoy","ecosystem":"Go","purl":"pkg:golang/github.com/envoyproxy/envoy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.30.10"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"}},{"package":{"name":"github.com/envoyproxy/envoy","ecosystem":"Go","purl":"pkg:golang/github.com/envoyproxy/envoy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.31.0"},{"fixed":"1.31.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"}},{"package":{"name":"github.com/envoyproxy/envoy","ecosystem":"Go","purl":"pkg:golang/github.com/envoyproxy/envoy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.32.0"},{"fixed":"1.32.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"}},{"package":{"name":"github.com/envoyproxy/envoy","ecosystem":"Go","purl":"pkg:golang/github.com/envoyproxy/envoy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.33.0"},{"fixed":"1.33.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-cf3q-gqg7-3fm9/GHSA-cf3q-gqg7-3fm9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}