voy crash can be triggered using a malformed JWT without a valid signature, and on any URI being accessed regardless of the <code>trigger_rules</code> in the JWT specification. Thus, this bug makes Envoy vulnerable to a potential DoS attack.</p><h2 id=impact-and-detection>Impact and detection</h2><p>Envoy is vulnerable if the following two conditions are satisfied:</p><ul><li>A JWT authentication policy is applied to it.</li><li>The JWT issuer (specified by <code>jwksUri</code>) uses the RSA algorithm for s