Description
Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.33.0, < 1.33.1, >= 1.32.0, < 1.32.4, >= 1.31.0, < 1.31.6, < 1.30.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | istioctl | 1.25.1-1.1 | openSUSE-SU-2025:14938-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.29.12.1-1.amzn2023 | ALAS2023-2025-926 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/envoyproxy/envoy | < 1.30.10 | 1.30.10 | GHSA-cf3q-gqg7-3fm9 |
| Go | github.com/envoyproxy/envoy | >= 1.31.0, < 1.31.6 | 1.31.6 | GHSA-cf3q-gqg7-3fm9 |
| Go | github.com/envoyproxy/envoy | >= 1.32.0, < 1.32.4 | 1.32.4 | GHSA-cf3q-gqg7-3fm9 |
| Go | github.com/envoyproxy/envoy | >= 1.33.0, < 1.33.1 | 1.33.1 | GHSA-cf3q-gqg7-3fm9 |
Advisories 2
- openSUSE-SU-2025:14938-1 istioctl-1.25.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2025-926 Moderate: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025