CVE-2025-62504

score

<0.1

cvss

6.5

epss

0.4%

published

2025-10-16

kev added

—

first seen

2026-10-21

Envoy < 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contains a use-after-free vulnerability in the Lua filter caused by response body rewrites exceeding buffer limits, letting attackers cause denial of service via crash, exploit requires crafted Lua script in response phase.