CVE-2025-30157
Envoyproxy Envoy ≤ 1.30.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSummary
CVE-2025-30157 is a medium-severity Improper Cleanup on Thrown Exception (CWE-460) vulnerability in Envoyproxy Envoy. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-17 (Fail-safe Procedures) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-30157 is a vulnerability in Envoy, a cloud-native high-performance edge/middle/service proxy, specifically affecting the ext_proc HTTP filter in versions prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10. The issue stems from a filter lifetime problem that causes Envoy to crash when a local reply is sent to the external server. A known trigger is the failure of a WebSocket handshake, which generates such a local reply and leads to the crash. It is associated with CWE-460 and has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
An attacker with network access to an affected Envoy instance can exploit this vulnerability with low attack complexity, though it requires user interaction. No privileges are needed from the attacker. Exploitation triggers a denial-of-service condition by crashing the Envoy process, with no impact on confidentiality or integrity.
Mitigation is available through upgrades to Envoy versions 1.33.1, 1.32.4, 1.31.6, or 1.30.10, which address the filter lifetime issue. Additional details are provided in the Envoy security advisory (GHSA-cf3q-gqg7-3fm9) and the fixing commit (8eda1b8ef5ba8663d16a737ab99458c039a9b53c).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7242
Vulnerability Data
Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue.…
more
A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires the system to fail to a known state on indicated failures, directly forcing proper state cleanup instead of leaving inconsistent state after an exception.
Mandates explicit fail-safe procedures on failures, which structurally enforces cleanup actions that the weakness omits.
Requires application of security engineering principles (e.g., fail-safe, complete mediation) during design that would eliminate improper exception cleanup.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce proper exception handling and resource cleanup.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing cleanup paths, thereby mitigating the weakness before deployment.
Secure SDLC mandates exception-handling and cleanup practices that reduce improper state after thrown exceptions.
Application security requirements can specify robust exception handling and resource-release rules.
Secure architecture principles include designing for safe failure and guaranteed cleanup on exceptions.
Secure coding standards directly require proper resource release and state restoration after exceptions.