CVE-2025-62409 Envoy allows large requests and responses to cause TCP connection pool crash
Attackers can cause TCP connection pool crashes in Envoy proxy by sending large requests or responses during connection closure, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62409?
CVE-2025-62409 is a medium-severity vulnerability in Envoyproxy Envoy, published on 16 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
Weakness: CWE-476
Which versions are affected by CVE-2025-62409?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.33.10, 1.34.9, 1.35.5, 1.36.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2025-62409?
Upgrade envoy to a fixed version for your release line: 1.33.10, 1.34.9, 1.35.5 or 1.36.1.
Is CVE-2025-62409 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62409 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2025-62409, GHSA-pq33-4jxh-hgm3.