Listen to this Post
How the CVE Works:
The vulnerability is a re-entry race condition in Envoy’s JwksFetcherImpl. When JWT authentication is configured with remote JWKS fetching and `allow_missing_or_failed` enabled, a request containing multiple JWT tokens triggers sequential validation. If the initial JWKS network fetch fails, the `onJwksError()` callback proceeds to validate the next token. This causes a second `fetch()` call on the same fetcher object. The original callback’s `reset()` method then erroneously clears the newly assigned `receiver_` and `request_` members belonging to the second fetch. When the asynchronous HTTP response for this second fetch eventually arrives, it dereferences the now-null pointer, leading to a segmentation fault and process crash.
dailycve form:
Platform: Envoy Proxy
Version: <=1.36.2
Vulnerability: Re-entry DoS
Severity: Critical
Date: 2025-12-03
Prediction: Patch 2025-12-17
What Undercode Say:
Example vulnerable JWT filter configuration cat << EOF > jwt-config.yaml providers: origin: issuer: https://idp.example.com remote_jwks: http_uri: uri: https://idp.example.com/.well-known/jwks.json forward: true from_headers: - name: x-jwt-token rules: - match: prefix: "/" requires: requires_any: requirements: - provider_name: origin EOF
// Simplified crash point in jwks_fetcher.cc
void JwksFetcherImpl::onJwksError() {
reset(); // Clears receiver_ and request_
// ... triggers next token validation, causing re-fetch
}
void JwksFetcherImpl::onSuccess(...) {
receiver_->onJwksSuccess(...); // CRASH: receiver_ is nullptr
}
How Exploit:
1. Configure Envoy with remote JWKS and `allow_missing_or_failed`.
2. Craft HTTP request with multiple JWT headers.
3. Block or tamper with JWKS HTTP response.
- Send request, causing sequential failed fetches and crash.
Protection from this CVE:
1. Apply upstream patch.
2. Disable `allow_missing_or_failed`.
3. Use local JWKS.
4. Implement network controls.
Impact:
Availability Impact: HIGH
Exploitability: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
