CVE-2025-62504

Envoy Lua filter use-after-free is fixed in versions 1.36.2, 1.35.6, 1.34.10, and 1.33.12. The vulnerability occurs when a Lua script rewriting the response body causes the size to exceed per_connection_buffer_limit_bytes, leading to a local reply that can override headers and crash the process, ...