CVE-2025-0752: Red Hat Openshift Service Mesh

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

Affected products

• Red Hat Openshift Service Mesh: version 2.5.6 only; version 2.6.3 only

Published 2025-01-28. Last modified 2026-06-17.