Envoy prior 1.32.10/1.33.7/1.34.5/1.35.1 session expiration

Summaryinfo

A vulnerability classified as critical was found in Envoy. Impacted is an unknown function. Such manipulation leads to session expiration. This vulnerability is listed as CVE-2025-55162. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Envoy and classified as critical. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a session expiration vulnerability. Using CWE to declare the problem leads to CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." Impacted is confidentiality, integrity, and availability. CVE summarizes:

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with __Secure- or __Host- prefixed cookie names, the filter fails to append the required Secure attribute to the Set-Cookie header during deletion. Modern browsers ignore this invalid request, causing the session cookie to persist. This allows a user to remain logged in after they believe they have logged out, creating a session hijacking risk on shared computers. The current implementation iterates through the configured cookie names to generate deletion headers but does not check for these prefixes. This failure to properly construct the deletion header means the user's session cookies are never removed by the browser, leaving the session active and allowing the next user of the same browser to gain unauthorized access to the original user's account and data. This is fixed in versions 1.32.10, 1.33.7, 1.34.5 and 1.35.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-55162 since 08/07/2025. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 281808 (Amazon Linux 2 : ecs-service-connect-agent, --advisory ALAS2ECS-2025-093 (ALASECS-2025-093)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.32.10, 1.33.7, 1.34.5 or 1.35.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at Tenable (281808) and CERT Bund (WID-SEC-2025-2085). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Amazon Linux 2
• Red Hat OpenShift

Productinfo

Name

• Envoy

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion