Envoy 1.37.8 fixes two crash vulnerabilities in authentication filters
Envoy 1.37.8 patches two denial-of-service vulnerabilities where CONNECT requests lacking a :path header could crash the oauth2 and api_key_auth filters.
Summary
The Envoy proxy project released version 1.37.8 with security fixes for two crash vulnerabilities. Both flaws involve requests without a :path header, which occurs with CONNECT requests. The oauth2 filter would crash outright, while the api_key_auth filter crashed when hide_credentials was enabled with a query key source and authentication came from another key source. Both filters now reject such requests with HTTP 400.
What the two CVEs fix
- GHSA-8vc2-jrm4-835w: oauth2 filter crashed on CONNECT requests missing
:path; now returns 400 Bad Request - GHSA-47vj-9r25-wv5j: api_key_auth filter crashed when
hide_credentials+ query key source combined with:path-less CONNECT request authenticated via alternate key source; now returns 400 - Both are denial-of-service vectors, not authentication bypasses
- Affects deployments using these filters with HTTP CONNECT or similar
:path-less methods
Why it matters
Envoy is a widely deployed edge and service mesh proxy in Kubernetes and cloud-native infrastructure. These crashes could be triggered remotely by any client sending a malformed CONNECT request, making the fixes relevant for production operators running affected filter configurations.
Original reference: github.com →