Envoy Proxy CVE-2025-62504

Exploitation requires that Envoy be configured with a Lua HTTP filter whose script rewrites the response body during the response phase, AND that the rewritten body exceed the configured per_connection_buffer_limit_bytes (default 1MB). This is a non-default configuration - stock Envoy deployments without a response-rewriting Lua filter are not affected. The crash path is triggered when the oversized rewritten body forces Envoy to emit a local reply that overrides the original response headers, producing dangling references. Limiting/mitigating factors: raising per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size), or raising per_request_buffer_limit_bytes / request_body_buffer_limit, reduces the likelihood of hitting the threshold but does NOT fix the underlying memory-safety flaw; only upgrading to a patched version does. No authentication is required per the CVSS vector (PR:N), and no user interaction is needed (UI:N).

This is a genuine but conditional denial-of-service issue, not a high-priority mass-exploitation threat. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) treats this as a network-reachable, low-complexity, unauthenticated crash, but that rating understates the preconditions: the description makes clear exploitation only occurs when a Lua filter is configured AND a Lua script rewrites a response body beyond per_connection_buffer_limit_bytes (default 1MB). That is a non-default deployment configuration, so AC:L is arguably optimistic - real complexity is higher. All non-availability impacts are correctly N (pure DoS via use-after-free, CWE-416). Corroborating signals point to low real-world urgency: EPSS is only 0.42% (34th percentile), the CVE is NOT on CISA KEV, and no public exploit was provided in the input. There is no conflict between the signals - they consistently indicate a legitimate memory-safety bug with limited exploitation likelihood because it depends on a specific Lua response-rewriting configuration. Priority should be driven by whether an organization actually runs the Lua filter in that mode, not by the headline 7.5 score.

In an Envoy deployment that uses a Lua filter to rewrite response bodies, an attacker (or even a legitimate client) elicits a response whose rewritten body exceeds the configured per_connection_buffer_limit_bytes (default 1MB). Envoy generates a local reply whose headers override the original response headers, leaving dangling references to freed memory and crashing the proxy, interrupting all traffic it fronts. No public proof-of-concept was identified at time of analysis, and triggering requires the specific Lua response-rewriting configuration rather than a default install.