Medium severity · published Jan 28, 2025
CVE-2025-0754
Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OpenShift Service Mesh 2 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0754
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0754
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-0754
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2339147
More from OpenShift Service Mesh 2
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.1
CVE-2026-42264
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
8.8
CVE-2026-27140
Code execution vulnerability in SWIG code generation in cmd/go
7.1
CVE-2025-0752
Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access
5.4
CVE-2024-11831
Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript