Vulnerability · Published Jan 28, 2025 · Assigned by redhat

CVE-2025-0754Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing

Medium 4.3

In plain English

A medium-severity security flaw in envoyproxy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.

Affected products (as reported)

Vendor	Product	Versions
	envoyproxy	2.6.32.5.6
Red Hat	OpenShift Service Mesh 2	see references
Red Hat	OpenShift Service Mesh 2	see references

Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2025-0754 vdb-entry, x_refsource_REDHAT
RHBZ#2339147 issue-tracking, x_refsource_REDHAT