CVE-2025-0752

CWE-444 — HTTP Request SmugglingCWE-416 — Use After Free5 documents5 sources
Severity
7.1HIGH
EPSS
0.2%
top 61.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Openshift Service Mesh
Timeline
PublishedJan 28

Description

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:HExploitability: 2.8 | Impact: 4.2

Affected Packages1 packages

▶NVDredhat/openshift_service_mesh2.5.6, 2.6.3+1

🔴Vulnerability Details

2
GHSA
GHSA-wpxv-x75w-vp46: A flaw was found in OpenShift Service Mesh 2↗2025-01-28
▶
CVEList
Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access↗2025-01-28
▶

📋Vendor Advisories

2
Red Hat
envoyproxy: OpenShift Service Mesh Envoy HTTP Header Sanitization Bypass Leading to DoS and Unauthorized Access↗2025-01-21
▶
Microsoft
A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox <↗2024-01-09
▶