https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 22:02:52 +0000 https://cve.radiocsirt.org/vuln/cve-2025-64527 <p><strong>Affected:</strong> envoyproxy envoy</p> <p>Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token&#39;s JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback&#39;s reset() then clears the second fetch&#39;s state (receiver_ and request_) which causes a crash when the async HTTP response arrives.</p> <p><strong>Affected:</strong> envoyproxy envoy</p> <p>Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes when JWT authentication is configured with the remote JWKS fetching, allow_missing_or_failed is enabled, multiple JWT tokens are present in the request headers and the JWKS fetch fails. This is caused by a re-entry bug in the JwksFetcherImpl. When the first token&#39;s JWKS fetch fails, onJwksError() callback triggers processing of the second token, which calls fetch() again on the same fetcher object. The original callback&#39;s reset() then clears the second fetch&#39;s state (receiver_ and request_) which causes a crash when the async HTTP response arrives.</p> https://cve.radiocsirt.org/vuln/cve-2025-64527