CVE-2025-64527

Executive Summary

CVE-2025-64527 is a denial-of-service (DoS) vulnerability in the Envoy proxy, affecting versions 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier. The flaw resides in the JWT authentication module when configured with remote JWKS fetching and allow_missing_or_failed enabled. When multiple JWT tokens are present in request headers and the JWKS fetch fails, a re-entry bug in JwksFetcherImpl causes a crash. This is triggered by a race condition where the onJwksError() callback processes a second token, leading to a double-free or use-after-free condition when the async HTTP response arrives. The vulnerability has a CVSS score of 6.5 (Medium) and no known public exploit or patch at this time.

Supply Chain & Package Security

Envoy is a high-performance proxy commonly used in service mesh architectures (e.g., Istio). The vulnerability is in the core proxy binary, not a package manager distribution. However, organizations using Envoy as a sidecar or edge proxy should treat this as a critical supply chain risk, as an unpatched version can lead to service disruption.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: Medium – Exploitation requires specific configuration (JWT with remote JWKS and allow_missing_or_failed enabled), but no authentication is needed.

Deep Dive & Mechanics

The vulnerability is a re-entry bug in the JwksFetcherImpl class. When Envoy processes multiple JWT tokens in a request, it uses a single JwksFetcherImpl instance to fetch JWKS keys. If the first token's JWKS fetch fails, the onJwksError() callback is invoked. This callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the state (receiver_ and request_) of the second fetch, causing a crash when the async HTTP response arrives.

Key components:

• JwksFetcherImpl: Manages JWKS fetching via HTTP.
• onJwksError(): Callback on fetch failure.
• reset(): Cleans up fetch state.
• receiver_ and request_: Internal pointers for async HTTP.

Trigger conditions:

1. JWT authentication configured with remote JWKS.
2. allow_missing_or_failed set to true.
3. Multiple JWT tokens in request headers.
4. JWKS fetch fails (e.g., network error, invalid URL).

Vulnerable vs. Patched Code

Vulnerable code (simplified):

void JwksFetcherImpl::onJwksError() {
  // Process next token
  if (has_next_token) {
    fetch(next_token);  // Re-enters fetch()
  }
  reset();  // Clears state for current fetch, but now affects next fetch
}

Patched code (hypothetical):

void JwksFetcherImpl::onJwksError() {
  // Save state before processing next token
  auto saved_state = state_;
  if (has_next_token) {
    fetch(next_token);  // Re-enters fetch()
  }
  // Only reset if no re-entry occurred
  if (saved_state == state_) {
    reset();
  }
}

The patch would prevent reset() from clearing state that belongs to a re-entered fetch.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Envoy proxy with JWT authentication and remote JWKS.
• allow_missing_or_failed set to true.
• Ability to send HTTP requests with multiple JWT tokens.

Exploit steps:

1. Set up a malicious JWKS endpoint that returns errors (e.g., 404 or timeout).
2. Send a request with two JWT tokens in the Authorization header (e.g., Bearer token1, Bearer token2).
3. The first token triggers a JWKS fetch that fails.
4. The second token triggers a re-entry, causing a crash.

Example request:

GET /protected HTTP/1.1
Host: envoy-proxy
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature1, Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature2

Blue Team

Detection:

• Monitor Envoy logs for repeated JWKS fetch failures.
• Look for crash dumps or core files in Envoy's working directory.
• Use network monitoring to detect requests with multiple JWT tokens.

Mitigation:

• Disable allow_missing_or_failed if not needed.
• Use local JWKS instead of remote fetching.
• Apply rate limiting on JWT token count per request.

Indicators of Compromise (IOCs)

• Log entries: JwksFetcherImpl::onJwksError followed by crash.
• Network traffic: Requests with multiple Bearer tokens in Authorization header.
• System artifacts: Core dumps from Envoy process.
• File hashes: N/A (no known exploit code).

Detection Engineering

YARA Rule

rule CVE_2025_64527_Envoy_JWT_Crash {
  meta:
    description = "Detects Envoy crash logs related to CVE-2025-64527"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-64527"
  strings:
    $log1 = "JwksFetcherImpl::onJwksError" nocase
    $log2 = "crash" nocase
    $log3 = "JWT" nocase
  condition:
    all of ($log*) and filesize < 1MB
}

Sigma Rule

title: Envoy JWT Crash Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Envoy crashes due to CVE-2025-64527
author: Valters IT
date: 2025-04-10
logsource:
  product: envoy
  service: proxy
detection:
  selection:
    - EventID: "CRASH"
    - Message: "*JwksFetcherImpl*"
  condition: selection
falsepositives:
  - Legitimate crashes from other causes
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64527 Envoy JWT Multiple Tokens"; flow:to_server; http.header; content:"Authorization"; content:"Bearer"; distance:0; within:100; pcre:"/Bearer\s+[A-Za-z0-9\-_]+?\.[A-Za-z0-9\-_]+?\.[A-Za-z0-9\-_]+?\s*,\s*Bearer/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Disable allow_missing_or_failed in JWT authentication configuration.
2. Use local JWKS files instead of remote fetching.
3. Restrict the number of JWT tokens per request via Envoy's max_tokens setting.

Long-term fixes:

• Apply vendor patch when available (monitor Envoy GitHub releases).
• Upgrade to a patched version (none yet).
• Implement network segmentation to limit exposure.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests with multiple JWT tokens.
• Monitor Envoy logs for JWKS fetch failures and restart the proxy automatically.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert