Cloudanix VulnDB

CVE-2025-64527

Medium · 6.5

CVSS

6.5

EPSS

0.5%

Published

Dec 5, 2025

CISA due date

—

The record

Envoy crashes when JWT authentication is configured with the remote JWKS fetching, `allow_missing_or_failed` is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/envoyproxy/envoy 0 1.33.13
Go github.com/envoyproxy/envoy 1.34.0 1.34.11
Go github.com/envoyproxy/envoy 1.35.0 1.35.7
Go github.com/envoyproxy/envoy 1.36.0 1.36.3
Bitnami envoy 0 1.33.13
go github.com/envoyproxy/envoy 1.34.0 1.34.11
go github.com/envoyproxy/envoy 1.35.0 1.35.7
go github.com/envoyproxy/envoy 1.36.0 1.36.3

Related vulnerabilities