{"id":"CVE-2025-43915","aliases":["EUVD-2025-13396","GHSA-42mr-jpwh-m9rv","GO-2025-3664","openSUSE-SU-2025:15144-1"],"status":"published","title":"Linkerd resource exhaustion vulnerability","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00336,"percentile":0.27279,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2025-05-05T00:00:00Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Go","package":"github.com/linkerd/linkerd2","fixed_in":["0.0.0-20250212165942-faa3f617eef5"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","fixed_in":["0.0.20250520T172319-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/linkerd/linkerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20250212165942-faa3f617eef5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/linkerd/linkerd2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250212165942-faa3f617eef5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/linkerd/linkerd2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250520T172319-1.1"}]}]}],"products":[{"vendor":"linkerd","product":"buoyant"},{"vendor":"linkerd","product":"linkerd"}],"references":[{"url":"https://www.buoyant.io/resources","tags":["Product","web"]},{"url":"https://docs.buoyant.io/security/advisories/2025-01/","tags":["Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43915","tags":["advisory"]},{"url":"https://docs.buoyant.io/security/advisories/2025-01","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3664","tags":["web"]},{"url":"https://github.com/advisories/GHSA-42mr-jpwh-m9rv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43915.json","tags":["advisory"]},{"url":"https://github.com/linkerd/linkerd2","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K67H4KZBU7OU4TE5W2HSO67IOYYYFVKW/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-43915","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-43915","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T00:00:00Z","modified":"2025-05-19T15:10:54.584Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-13396","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T00:00:00Z","modified":"2025-05-19T15:10:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:44.291904Z"}],"ghsa":[{"id":"GHSA-42mr-jpwh-m9rv","title":"Linkerd resource exhaustion vulnerability","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T18:32:53Z","modified":"2025-05-20T20:26:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:43.998596Z"}],"nvd":[{"id":"CVE-2025-43915","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T17:18:49.603Z","modified":"2026-06-17T09:24:44.027Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:11:04.33372Z"}],"osv":[{"id":"CVE-2025-43915","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T00:00:00Z","modified":"2026-10-28T02:30:41.19023377Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-42mr-jpwh-m9rv","title":"Linkerd resource exhaustion vulnerability","description":"In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.","status":"published","published":"2025-05-05T18:32:53Z","modified":"2025-05-20T20:26:16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"GO-2025-3664","title":"Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2","description":"Linkerd resource exhaustion vulnerability in github.com/linkerd/linkerd2","status":"published","published":"2025-05-20T17:23:19Z","modified":"2025-05-20T18:12:02.867422Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15144-1","title":"govulncheck-vulndb-0.0.20250520T172319-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250520T172319-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-22T00:00:00Z","modified":"2026-03-23T04:53:24.628933Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}