Disclosure summary
Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.
Source-reported weakness categories
CWE-476
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-62409
Open original source · Updated Oct 09, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| envoyproxy | envoy | * {"versionStartIncluding":"1.35.0","versionEndExcluding":"1.35.5"} |
| envoyproxy | envoy | 1.36.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Vendor Advisory
- github.com — Vendor Advisory
PUBLISHED 2025-10-16T14:15:39-04:00
MODIFIED 2026-10-09T06:10:00-04:00
INGESTED 2026-10-10T20:50:24-04:00