Skip to content

Envoy proxy crash(CRE-2025-0122) #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Jul 9, 2025
Merged

Envoy proxy crash(CRE-2025-0122) #117

merged 3 commits into from
Jul 9, 2025

Conversation

aryel780
Copy link
Contributor

@aryel780 aryel780 commented Jul 7, 2025

Envoy Proxy Crash: Assertion Failure

Detects critical Envoy proxy crashes caused by assertion failures (e.g., invalid configurations, filter initialization errors, or runtime invariant violations). Assertion failures in Envoy typically include log entries containing critical][assert] followed by critical][backtrace] and ultimately lead to process termination. This high-severity failure often requires immediate intervention to restore traffic flow.

This rule helps identify problems such as:

  • Misconfigured listener or filter definitions that trigger internal assertions
  • Runtime invariant violations leading to aborts and backtraces
  • Filter or extension bugs causing Envoy to crash during startup or runtime
  • Cascading outages in edge or sidecar deployments due to sudden Envoy termination
  • Repeated crash loops that block traffic until manual restart or configuration fix

✅ Use Case:

This CRE rule is perfect for:

  • SREs and platform teams overseeing Envoy sidecars or gateways
  • Service mesh operators detecting proxy crashes in CI/CD or production
  • Incident responders who need automated detection of assertion failures before outages spread

Reproducible test setup (Maintainers invited): envoy-proxy-crash
Live CRE Link: CRE playground

/claim #97
/close #97

@algora-pbc algora-pbc bot mentioned this pull request Jul 7, 2025
Closed
@parvati-l
Copy link

Hi @aryel780 , Your PR looks good but isn't this issue patched in latest versions I have tried to reproduce this but not working unless we use deprecated configs. If you are able to reproduce this issue in the latest versions v1.33 or v1.34 and mainly v1.34.1 please take time to rise issue in official envoy github site : https://github.com/envoyproxy/envoy/issues.
Ty

@tonymeehan tonymeehan merged commit 89abf6b into prequel-dev:main Jul 9, 2025
@aryel780 aryel780 deleted the envoy-proxy-crash branch July 9, 2025 17:37
@rvhost
Copy link
Contributor

rvhost commented Jul 9, 2025

@tonymeehan Hey, I'm really sorry about this. I was on a bus when I got the merge notification and accidentally touched the revert button while checking the PR on mobile. I didn't mean to revert the merge you did for @aryel780's PR #117. Could you please help me revert my accidental revert commit (e50f104) to restore the original changes? I was just reviewing the PR and made a mistake on mobile. Thanks for understanding and sorry for the trouble. Hey @aryel780 sorry man it's my mistake. Thank you for understanding.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
🙋 Bounty claim
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Multiple Winners] Envoy: Reproduce A High-Severity Failure & Write a Detection Rule [Submit by July 6 11:59 pm ET]
4 participants
@aryel780 @parvati-l @rvhost @tonymeehan