CVE-2025-54588: Envoyproxy Envoy Use-After-Free Vulnerability

CVE-2025-54588 Overview

CVE-2025-54588 is a use-after-free (UAF) vulnerability affecting Envoy, the open source L7 proxy and communication bus designed for large modern service-oriented architectures. The vulnerability exists in Envoy's DNS cache implementation within the Dynamic Forward Proxy functionality, potentially causing abnormal process termination and denial of service conditions.

The flaw occurs when a completion callback for a DNS resolution triggers new DNS resolutions or removes existing pending resolutions. This memory safety issue can be exploited remotely without authentication, making it a significant concern for organizations relying on Envoy for their service mesh and proxy infrastructure.

Critical Impact

Remote attackers can cause denial of service through abnormal process termination by exploiting the use-after-free condition in Envoy's DNS cache, potentially disrupting critical service mesh infrastructure.

Affected Products

• Envoyproxy Envoy versions 1.34.0 through 1.34.4
• Envoyproxy Envoy version 1.35.0
• Systems with Dynamic Forwarding Filter enabled and envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag enabled

Discovery Timeline

• September 3, 2025 - CVE-2025-54588 published to NVD
• September 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54588

Vulnerability Analysis

This use-after-free vulnerability resides in Envoy's Dynamic Forward Proxy implementation, specifically within the DNS cache handling mechanism. The vulnerability is triggered when DNS resolution completion callbacks interact with the cache in an unsafe manner, either by initiating new DNS resolutions or removing pending resolutions while memory is still being accessed.

The attack can be performed over the network without requiring authentication or user interaction. Successfully exploiting this vulnerability results in denial of service through abnormal process termination, affecting the availability of services relying on the affected Envoy proxy instances.

Root Cause

The root cause is a classic use-after-free condition (CWE-416) in the DNS cache implementation. When a DNS resolution completion callback executes, it can trigger operations that modify the DNS cache state—specifically, initiating new resolutions or removing pending ones. If these operations deallocate memory that the callback or related code still references, the proxy attempts to access freed memory, leading to undefined behavior and process crashes.

The vulnerability manifests when three specific conditions are met simultaneously:

1. The Dynamic Forwarding Filter is enabled
2. The envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag is enabled
3. The Host header is modified between the Dynamic Forwarding Filter and Router filters

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker can craft HTTP requests that manipulate the Host header in a way that triggers the race condition in the DNS cache. By sending specifically crafted requests that cause the Host header modification scenario, an attacker can reliably trigger the use-after-free condition, causing the Envoy proxy process to terminate abnormally.

This attack requires no privileges or authentication, and does not require user interaction. The exploitation targets the availability of the system, as successful attacks cause denial of service through process termination.

Detection Methods for CVE-2025-54588

Indicators of Compromise

• Unexpected Envoy proxy process crashes or restarts in container orchestration logs
• Segmentation faults or memory access violations in Envoy crash dumps
• Increased error rates in upstream services due to proxy unavailability
• Anomalous patterns in DNS resolution timing or failures

Detection Strategies

• Monitor Envoy process stability and implement alerting on unexpected restarts or crashes
• Analyze crash dumps for memory corruption signatures indicating use-after-free conditions
• Implement log analysis for patterns of requests with modified Host headers between filters
• Deploy network monitoring to identify suspicious request patterns targeting Dynamic Forward Proxy functionality

Monitoring Recommendations

• Enable comprehensive logging for the Dynamic Forward Proxy filter to track DNS resolution events
• Configure container orchestration platforms to alert on repeated Envoy container restarts
• Implement application performance monitoring to detect proxy availability degradation
• Monitor memory allocation patterns in Envoy processes for anomalies

How to Mitigate CVE-2025-54588

Immediate Actions Required

• Upgrade to Envoy version 1.34.5 or 1.35.1 immediately
• If immediate patching is not possible, disable the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag as a temporary workaround
• Review Envoy configurations for Dynamic Forward Proxy filter usage and assess exposure
• Implement additional monitoring for Envoy process stability during the mitigation window

Patch Information

Envoy has released patched versions that address this use-after-free vulnerability. Organizations should upgrade to the following versions:

• Version 1.34.5 for users on the 1.34.x branch - see GitHub Release v1.34.5
• Version 1.35.1 for users on the 1.35.x branch - see GitHub Release v1.35.1

For detailed information about this vulnerability, refer to the GitHub Security Advisory GHSA-g9vw-6pvx-7gmw.

Workarounds

• Set the envoy.reloadable_features.dfp_cluster_resolves_hosts runtime flag to false to disable the vulnerable code path
• Consider temporarily disabling the Dynamic Forward Proxy filter if not critical to operations
• Implement request filtering at upstream load balancers to limit Host header modification scenarios
• Deploy redundant Envoy instances to maintain availability if exploitation occurs

# Configuration example - Disable vulnerable feature flag
# Add to Envoy bootstrap configuration or runtime layer
envoy.reloadable_features.dfp_cluster_resolves_hosts: false