Skip to content

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: GHSA-mp85-7mrq-r866 #4194

New issue
New issue
Open
Open
x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: GHSA-mp85-7mrq-r866#4194
Labels
possibly not Gotriaged
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Dec 5, 2025

Advisory GHSA-mp85-7mrq-r866 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:

Summary

Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails.

Details

This is caused by a re-entry bug in the JwksFetcherImpl. When the first token's JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object.

The original callback's reset() then clears the second fetch's state (receiver_ and request_) which causes a crash when the async HTTP response arrive...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      non_go_versions:
        - introduced: TODO (earliest fixed "1.33.13", vuln range "<= 1.33.12")
        - introduced: TODO (earliest fixed "1.34.11", vuln range ">= 1.34.0, <= 1.34.10")
        - introduced: TODO (earliest fixed "1.35.7", vuln range ">= 1.35.0, <= 1.35.6")
        - introduced: TODO (earliest fixed "1.36.3", vuln range ">= 1.36.0, <= 1.36.2")
      vulnerable_at: 1.36.3
summary: |-
    Envoy crashes when JWT authentication is configured with the remote JWKS
    fetching in github.com/envoyproxy/envoy
cves:
    - CVE-2025-64527
ghsas:
    - GHSA-mp85-7mrq-r866
references:
    - advisory: https://github.com/advisories/GHSA-mp85-7mrq-r866
    - advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-mp85-7mrq-r866
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-64527
notes:
    - fix: 'module merge error: could not merge versions of module github.com/envoyproxy/envoy: invalid or non-canonical semver version (found TODO (earliest fixed "1.33.13", vuln range "<= 1.33.12"))'
source:
    id: GHSA-mp85-7mrq-r866
    created: 2025-12-05T19:01:21.481171151Z
review_status: UNREVIEWED

Metadata

Metadata

Assignees

No one assigned

    Labels

    possibly not Gotriaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions