Openshift Service Mesh vulnerabilities

2 known vulnerabilities in Openshift Service Mesh from Red Hat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  envoy: Asymmetric Resource Consumption (Amplification)

  CVE-2026-47774Jun 17, 2026Envoyproxy

  Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 downstream request processing allows an unauthenticated remote client to trigger exc

• 7.1 High severity

  OpenShift Service Mesh 2: Inconsistent Interpretation of HTTP Requests

  CVE-2025-0752Jan 28, 2025Red Hat

  A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.