CVE-2025-62504: envoy before 1.33.12 (exclusive), from 1.34.0 (inclusive), before 1.34.10 (exclusive), from 1.35.0 (inclusive), before…

Affected technology

envoy · before 1.33.12 (exclusive)
envoyproxy

envoy · from 1.34.0 (inclusive), before 1.34.10 (exclusive)
envoyproxy

envoy · from 1.35.0 (inclusive), before 1.35.6 (exclusive)
envoyproxy

envoy · from 1.36.0 (inclusive), before 1.36.2 (exclusive)
envoyproxy

envoy · >= 1.36.0, <= 1.36.1, >= 1.350, <= 1.35.5, >= 1.34.0, <= 1.34.9, <= 1.33.11
envoyproxy

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and integrity impact as none; availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.