CVE-2025-0752

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-0752	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2339115	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openshift_service_mesh:2.5.6:::::::*
	cpe:2.3:a:redhat:openshift_service_mesh:2.6.3:::::::*

History

31 Jul 2025, 18:29

Type	Values Removed	Values Added
CPE		cpe:2.3:a:redhat:openshift_service_mesh:2.6.3:::::::* cpe:2.3:a:redhat:openshift_service_mesh:2.5.6:::::::*
First Time		Redhat openshift Service Mesh Redhat
References	~~() https://access.redhat.com/security/cve/CVE-2025-0752 -~~	() https://access.redhat.com/security/cve/CVE-2025-0752 - Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2339115 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2339115 - Vendor Advisory
Summary		(es) Se encontró una falla en OpenShift Service Mesh 2.6.3 y 2.5.6. Es posible que se produzcan ataques de evasión de limitadores de velocidad, de control de acceso, de agotamiento de CPU y memoria y de repetición debido al encabezado HTTP desinfección incorrecto en Envoy.

28 Jan 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-28 10:15

Updated : 2025-07-31 18:29

NVD link : CVE-2025-0752

Mitre link : CVE-2025-0752

CVE.ORG link : CVE-2025-0752

JSON object : View

Products Affected

redhat

openshift_service_mesh

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

6.3 /10