Access Control Vulnerabilities in OpenShift Service Mesh by Red Hat
CVE-2025-0752

6.3MEDIUM

Key Information:

Vendor
Red Hat
Status
Openshift Service Mesh 2
Vendor
CVE Published:
28 January 2025

Summary

A flaw in OpenShift Service Mesh versions 2.6.3 and 2.5.6 has been identified, which may allow for rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and potential replay attacks. This vulnerability stems from inadequate sanitization of HTTP headers within Envoy, necessitating urgent attention to patch affected systems to prevent exploitation.

References

https://access.redhat.com/security/cve/CVE-2025-0752
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2339115
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.