CVE-2025-30157

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30157
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30157.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30157
Aliases
Downstream
Related
Published
2025-03-21T14:49:18.113Z
Modified
2026-08-12T15:16:23.624854Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Envoy crashes when HTTP ext_proc processes local replies
Details

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.

Database specific 
{
    "cwe_ids": [
        "CWE-460"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30157.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9adc6873ea3abc2305d164af41ea713bb45152dd
Introduced
7b8baff1758f0a584dcc3cb657b5032000bcb3d7
Fixed
8b0d0de9e7d601989121cbb42efc170c342f55c3
Introduced
86dc7ef91ca15fb4957a74bd599397413fc26a24
Fixed
cb67308e01e8f035f2977f153d20d99a54cb1da4
Introduced
b0f43d67aa25c1b03c97186a200cc187f4c22db3
Fixed
8eda1b8ef5ba8663d16a737ab99458c039a9b53c
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:envoyproxy:envoy:1.33.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.30.10"
        },
        {
            "introduced": "1.31.0"
        },
        {
            "fixed": "1.31.6"
        },
        {
            "introduced": "1.32.0"
        },
        {
            "fixed": "1.32.4"
        },
        {
            "introduced": "1.33.0"
        },
        {
            "last_affected": "1.33.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.33.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.30.5
v1.30.6
v1.30.7
v1.30.8
v1.30.9
v1.31.0
v1.31.1
v1.31.2
v1.31.3
v1.31.4
v1.31.5
v1.32.0
v1.32.1
v1.32.2
v1.32.3
v1.33.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0

Database specific

vanir_signatures_modified 
"2026-08-12T15:16:23Z"
vanir_signatures 
[
    {
        "id": "CVE-2025-30157-0ab17785",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131107222101786345073671344768637688516",
                "219310465844859572002083520237094622140",
                "266204614104953369355689299540733038565"
            ]
        },
        "source": "https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c",
        "target": {
            "file": "source/extensions/filters/http/ext_proc/ext_proc.h"
        }
    },
    {
        "id": "CVE-2025-30157-3426cb99",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "104788104435975027144784111992021314565",
                "126602166397583842061410150030390187922",
                "328477059728527897037608437804609887847",
                "131204744563129597769789680942071510244",
                "244873183816677666353347552793792954197",
                "60274442199458527312234911024310920421",
                "120395095692324732441389757229971149318",
                "19990929774941915240165922035079353089",
                "5625019625493324857300223908946513159",
                "110973575682060680996234595202656074400",
                "65750863178146682149261283764239191807",
                "19133073729328977944058538349737305800",
                "235883629140950495644257161399368874396",
                "262673547002466384584703133528529055882"
            ]
        },
        "source": "https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c",
        "target": {
            "file": "test/extensions/filters/http/ext_proc/ext_proc_misc_test.cc"
        }
    },
    {
        "id": "CVE-2025-30157-f33dc8df",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79712408649916740326025507022540481296",
                "25495714045157038637322642769908678571",
                "52058331756079616835538700678553070843",
                "322318600054933349052125588450060845213",
                "166519388076965811213541388181571030716",
                "330040150232917346293243912962234022276",
                "246995351906158912600667086697741049429",
                "162351276269284561165518139247861000969"
            ]
        },
        "source": "https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c",
        "target": {
            "file": "source/common/router/router.h"
        }
    },
    {
        "id": "CVE-2025-30157-fafd4579",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "30194948638454257386779764387151425144",
                "167798196906891989626433148408180070218",
                "249084642809662306428799710429784003743",
                "168382228229502581714931651007745254179",
                "112324955763538154936775478766254269775",
                "171680254834255452050177127767755846953",
                "327674794315972961491357729946898061004"
            ]
        },
        "source": "https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30157.json"