CVE-2025-43915

Linkerd resource exhaustion vulnerability

6.5 MediumFix available

In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.34%Up 0.3 points since May 6, 2025

What each source reports

CVE List Score used 6.5

Record: CVE-2025-43915
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2025-13396 6.5

Record: EUVD-2025-13396
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-42mr-jpwh-m9rv 6.5

Linkerd resource exhaustion vulnerability

Record: GHSA-42mr-jpwh-m9rv
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 6.5

Record: CVE-2025-43915
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 6.5

Record: CVE-2025-43915
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVGHSA-42mr-jpwh-m9rv 6.5

Linkerd resource exhaustion vulnerability

Record: GHSA-42mr-jpwh-m9rv
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVGO-2025-3664 No score

Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2

Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2

Record: GO-2025-3664
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15144-1 No score

govulncheck-vulndb-0.0.20250520T172319-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250520T172319-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15144-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/linkerd/linkerd2` Go	before 0.0.0-20250212165942-faa3f617eef5	0.0.0-20250212165942-faa3f617eef5
`github.com/linkerd/linkerd2` Go	All versions	None known
`govulncheck-vulndb` openSUSE:Tumbleweed	before 0.0.20250520T172319-1.1	0.0.20250520T172319-1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-43915 is a medium vulnerability (CVSS 6.5) in Linkerd Buoyant, published May 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in github.com/linkerd/linkerd2 0.0.0-20250212165942-faa3f617eef5.