CVE-2025-64527
Envoy crashes when JWT authentication is configured with the remote JWKS fetching
Impact
### Summary Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. ### Details This is caused by a re-entry bug in the `JwksFetcherImpl`. When the first token's JWKS fetch fails, `onJwksError()` callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback's reset() then clears the second fetch's state (`receiver_ and request_`) which causes a crash when the async HTTP response arrives. ### PoC * `allow_missing_or_failed` or `allow_missing` is enabled * The client send 2 Authorization headers * the remote JWKS fetching failed * There will be crash ### Impact DoS and Crash ### Mitigation * Disable the `allow_missing_or_failed` or `allow_missing`
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/envoyproxy/envoy | >= 1.36.0, <= 1.36.2 | 1.36.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Envoyproxy | Envoy | before 1.33.13 from 1.34.0 before 1.34.11 from 1.35.0 before 1.35.7 from 1.36.0 before 1.36.3 |