Envoy Project Patches Two Flaws: DoS (CVE-2025-54588) and Session Hijacking (CVE-2025-55162) Risks

The Envoy Project has issued a security advisory addressing two vulnerabilities in its L7 proxy and communication bus: a DoS flaw in the DNS cache (CVE-2025-54588) and a session hijacking risk in the OAuth2 filter (CVE-2025-55162).

According to GHSA-g9vw-6pvx-7gmw, the first is a use-after-free in Envoy’s DNS cache that can cause abnormal process termination, affecting Dynamic Forward Proxy from version v1.34.0 and capable of triggering a DoS when specific conditions are met; users are urged to upgrade to v1.35.1 or v1.34.5, or disable the relevant runtime flag as a temporary workaround.

The second vulnerability arises from insufficient session expiration in the OAuth2 filter, with a CVSS 6.3, where Set-Cookie headers fail to delete cookies with certain prefixes, potentially allowing a session to persist and enabling session hijacking on shared machines; affected versions include all ≤1.35, and patches are available in 1.35.1, 1.34.5, 1.33.7 and 1.32.10, alongside guidance to avoid using __Secure- or __Host- prefixes in the OAuth2 filter. Users are encouraged to apply the patched releases to mitigate both issues.