Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.12.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2025-052 advisory.

    Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and     1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external     server due to the filter's life time issue. A known situation is the failure of a websocket handshake will     trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4,     1.31.6, and 1.30.10. (CVE-2025-30157)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-926 advisory.

    Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and     1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external     server due to the filter's life time issue. A known situation is the failure of a websocket handshake will     trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4,     1.31.6, and 1.30.10. (CVE-2025-30157)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and
    1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external
    server due to the filter's life time issue. A known situation is the failure of a websocket handshake will
    trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4,
    1.31.6, and 1.30.10. (CVE-2025-30157)

ID	Name	Product	Family	Type	Severity
235072	Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2025-052)	Nessus	Amazon Linux Local Security Checks	Local	high
234331	Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2025-926)	Nessus	Amazon Linux Local Security Checks	Local	high
421182	SCA: security update for github.com/envoyproxy/envoy (GHSA-cf3q-gqg7-3fm9)	Tenable Cloud Security	SCA Checks	Local	high
421182	SCA: security update for github.com/envoyproxy/envoy (GHSA-cf3q-gqg7-3fm9)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2025-30157

high

Tenable Plugins

high

high

high

high