Envoy Proxy CVE-2025-62409

Exploitation requires the Envoy instance to be deployed in one of the affected modes: TCP proxy, or mixed HTTP/1 and HTTP/2 use cases distinguished via ALPN - plain single-protocol HTTP deployments are not indicated as affected. The crash is triggered specifically when a connection is closing while upstream data is still arriving, combined with large requests or responses, a timing-dependent ('can potentially trigger') condition that acts as a limiting factor on reliable exploitation. No authentication is required (PR:N) and no user interaction (UI:N), but the attacker must be able to send traffic through the proxy and induce the large-data + connection-close state. Impact is limited to availability (process/connection-pool crash); there is no data exposure or code execution.

This is a medium-severity availability-only flaw (CVSS 4.0 base 6.6, vendor-assigned) with a clear real-world risk ceiling: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, unauthenticated condition, but all impact metrics except VA are None - this is a denial-of-service only (CWE-476 null pointer dereference), with no confidentiality or integrity impact. Multiple signals point AWAY from urgent prioritization: EPSS is only 0.46% (38th percentile), the vendor-provided vector carries E:U (Exploit Maturity: Unproven), there is no CISA KEV listing, and no public exploit was provided. Note a tension between the vendor's AC:L/AT:N rating and the description: exploitation depends on a specific timing/race condition ('connection is closing but upstream data is still coming') AND a specific deployment (TCP proxy or mixed HTTP/1 & HTTP/2 use cases selected via ALPN), which argues for higher attack complexity / an attack requirement than the raw vector suggests - verify exploit reliability with the vendor advisory. Overall: a genuine DoS worth patching on exposed Envoy data planes, but not a drop-everything issue - prioritize it below any integrity/confidentiality or actively-exploited bugs.

A remote attacker routes large requests (or elicits large responses) through an internet- or mesh-facing Envoy proxy configured for TCP proxy or mixed HTTP/1 & HTTP/2 via ALPN. By causing a connection to close while upstream data is still arriving, the attacker triggers a null pointer dereference in the buffer watermark callback, crashing the TCP connection pool and causing denial of service. No public exploit was identified at time of analysis, and the vendor marks exploit maturity as Unproven.