Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Envoy Proxy NULL Pointer Dereference Vulnerability - CVE-2025-62409 - Vulnerability Database
Envoy Proxy

Envoy Proxy NULL Pointer Dereference Vulnerability - CVE-2025-62409

High
Reference: CVE-2025-62409
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-62409
Title: Envoy Proxy NULL Pointer Dereference Vulnerability
Overview:

Envoy is a cloud-native open source edge and service proxy. Prior to 1.36.1 1.35.5 1.34.9 and 1.33.10 large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 amp 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1 1.35.5 1.34.9 and 1.33.10.