A failure in Envoy's rate limit filter, triggered when the response phase limit with apply_on_stream_done is enabled and the response phase request fails directly, can cause a crash of the Envoy process. The underlying weakness is a Use After Free error (CWE-416), which allows the application to access invalid memory after a gRPC client’s state has been improperly cleaned. The crash results in a denial-of-service condition, interrupting the availability of all services that depend on the affected Envoy instance.

The vulnerability affects the Envoy proxy from the envoyproxy project. Versions prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13 are impacted; these releases can be identified by the corresponding CPE strings for envoyproxy:envoy.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The advisory does not list this vulnerability in the CISA KEV catalog. Exploitation would most likely require deliberate configuration of both request and response phase rate limits or an attacker who can force the response phase request to fail, making the attack vector configuration‑dependent rather than easy to trigger remotely.