CVE Feed

    Dashboard / CVE / CVE-2025-0754

    CVE-2025-0754

    The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.

    Published:Jan 23, 2025
    Last Modified:Apr 15, 2026
    EPS:Jan 28, 2025
    EPSS Score:0.00222
    CVSS Score:4.3

    Affected Products

    Vendor
    Redhat
    Product
    Service Mesh

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-12143 (CVSS 8.7) — form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `fiel…
    CVE-2026-46625 (CVSS 7.5) — JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's i…
    CVE-2026-11332 (CVSS 7.8) — A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications …
    CVE-2026-42044 (CVSS 6.5) — Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios librar…
    CVE-2025-11060 (CVSS 5.7) — A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows re…
    CVE-2025-8556 (CVSS 3.7) — A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker …
    CVE-2025-6547 (CVSS 9.1) — Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue …
    CVE-2025-6545 (CVSS 9.1) — Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulne…
    CVE-2025-22871 (CVSS 9.1) — The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This …
    CVE-2025-26791 (CVSS 4.5) — DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cro…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High