GHSA-mp85-7mrq-r866

Suggest an improvement
Source
https://github.com/advisories/GHSA-mp85-7mrq-r866
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mp85-7mrq-r866/GHSA-mp85-7mrq-r866.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mp85-7mrq-r866
Aliases
Published
2025-12-05T18:12:39Z
Modified
2025-12-06T12:26:13.731160Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy crashes when JWT authentication is configured with the remote JWKS fetching
Details

Summary

Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Details

This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrives.

PoC

  • allow_missing_or_failed or allow_missing is enabled
  • The client send 2 Authorization headers
  • the remote JWKS fetching failed
  • There will be crash

Impact

DoS and Crash

Mitigation

  • Disable the allow_missing_or_failed or allow_missing
Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2025-12-03T18:15:46Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-476"
    ],
    "github_reviewed_at": "2025-12-05T18:12:39Z"
}
References

Affected packages

Go

github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.36.0
Fixed
1.36.3

Database specific

last_known_affected_version_range

"<= 1.36.2"

github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.35.0
Fixed
1.35.7

Database specific

last_known_affected_version_range

"<= 1.35.6"

github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
1.34.0
Fixed
1.34.11

Database specific

last_known_affected_version_range

"<= 1.34.10"

github.com/envoyproxy/envoy

Package

Name
github.com/envoyproxy/envoy
View open source insights on deps.dev
Purl
pkg:golang/github.com/envoyproxy/envoy

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.33.13

Database specific

last_known_affected_version_range

"<= 1.33.12"