Listen to this Post
The vulnerability occurs in Envoy’s JWT authentication filter when configured to fetch JSON Web Key Sets (JWKS) remotely from a server. Specifically, when `allow_missing_or_failed` or `allow_missing` is enabled, and a request contains multiple JWT tokens in its headers, a re-entry bug in the `JwksFetcherImpl` class leads to a crash. When the first token’s JWKS fetch fails due to network issues or server errors, the `onJwksError()` callback is triggered. This callback proceeds to process the second JWT token in the request, which initiates another `fetch()` call on the same `JwksFetcherImpl` object. However, the original callback’s `reset()` method is invoked, which clears the internal state variables `receiver_` and `request_` of the fetcher. Meanwhile, the second asynchronous HTTP fetch operation is still pending. When the HTTP response for the second fetch eventually arrives, it attempts to access the cleared state, resulting in a null pointer dereference or invalid memory access. This causes Envoy to crash abruptly, denying service to all subsequent requests. The issue is exacerbated in high-traffic environments where multiple JWT tokens are common, and JWKS servers may be unreliable. The bug is rooted in improper state management during error handling, allowing overlapping fetch operations on a shared object without adequate synchronization or checks.
Platform: Envoy
Version: 1.33.12-1.36.2
Vulnerability: JWT auth crash
Severity: Critical
Date: Dec 3, 2025
Prediction: Patch released Dec2025
What Undercode Say:
Analytics
envoy --version curl -v http://localhost:10000/config_dump grep -r "allow_missing_or_failed" /etc/envoy/
jwt_provider: remote_jwks: http_uri: uri: http://example.com/jwks.json cache_duration: 300s allow_missing_or_failed: true
Exploit
Send HTTP requests with multiple JWT headers to Envoy with a failing JWKS server; trigger crash via concurrent error handling.
Protection from this CVE
Update to patched versions; disable `allow_missing_or_failed` if possible; use local JWKS files.
Impact
Service disruption, denial-of-service, and unpredictable crashes in production environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
