CVE-2025-0752: Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
Other sources
The vulnerability allows an attacker to manipulate Envoy’s trust model by injecting headers that modify request handling. This can lead to unauthorized access, request amplification, and denial-of-service conditions within a service mesh.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What are the risks associated with CVE-2025-0752?
CVE-2025-0752 poses risks such as rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and potential replay attacks.
What versions of OpenShift Service Mesh are affected by CVE-2025-0752?
CVE-2025-0752 affects Red Hat OpenShift Service Mesh versions 2.6.3 and 2.5.6.
How can I mitigate the vulnerabilities associated with CVE-2025-0752?
Mitigation for CVE-2025-0752 involves implementing proper HTTP header sanitization and monitoring for unusual traffic patterns.
Is there a patch available for CVE-2025-0752?
There is currently no specific patch provided for CVE-2025-0752, but it is advisable to update to the latest version of the affected software.
What impact does CVE-2025-0752 have on system performance?
CVE-2025-0752 can lead to significant system performance issues, including potential CPU and memory exhaustion.