Redhat Openshift Service Mesh vulnerabilities

• envoyproxy envoy, red hat openshift service mesh 2.6, openshift service mesh 3.0 +4 more +6 more Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification CVE-2026-47774 Fix available 7.5 HighJune 17, 2026
• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 more Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable CVE-2026-29063 Fix available 8.7 HighMarch 4, 2026
• red hat openshift service mesh 2, redhat openshift service mesh +1 more Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access CVE-2025-0752 7.1 HighJanuary 28, 2025
• kiali, red hat openshift service mesh 2.1, openshift service mesh 2.3 for rhel 8 +1 more +3 more Kiali: error message spoofing in kiali ui CVE-2022-3962 Fix available 4.3 MediumSeptember 23, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• redhat servicemesh-operator, openshift service mesh +1 more A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do... CVE-2021-3586 Fix available 9.8 CriticalAugust 22, 2022
• netlify kiali-operator, redhat openshift service mesh +1 more Access control flaw in Kiali CVE-2021-3495 Fix available 8.8 HighJune 1, 2021
• istio, redhat openshift service mesh +1 more Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.13 security update CVE-2019-25014 6.5 MediumJanuary 29, 2021
• saml project saml, fedoraproject fedora, grafana +3 more +5 more XML Processing error in github.com/crewjam/saml CVE-2020-27846 Fix available 9.8 CriticalDecember 21, 2020
• [kiali] kiali, redhat openshift service mesh +1 more Insufficient Session Expiration in Kiali CVE-2020-1762 Fix available 7.0 HighApril 27, 2020
• kiali, redhat openshift service mesh +1 more Hard coded cryptographic key in Kiali CVE-2020-1764 Public exploitFix available 8.6 HighMarch 26, 2020
• envoyproxy envoy, redhat openshift service mesh +1 more Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update CVE-2020-8661 7.5 HighMarch 4, 2020
• envoyproxy envoy, redhat openshift service mesh, debian linux +2 more Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update CVE-2020-8659 7.5 HighMarch 4, 2020
• red hat openshift-service-mesh/kiali-rhel7-operator, redhat openshift service mesh +1 more An insecure modification vulnerability in the /etc/passwd file was found in all versions of... CVE-2020-1704 7.0 HighFebruary 17, 2020
• istio, redhat openshift service mesh +1 more Istio 1.3 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path... CVE-2020-8595 Fix available 7.3 HighFebruary 12, 2020
• apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 more Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service CVE-2019-9518 Fix available EPSS 25.4% 7.5 HighAugust 13, 2019
• apache http server, traffic server, apple swiftnio +20 more +22 more Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service CVE-2019-9517 Fix available EPSS 27.0% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 more Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service CVE-2019-9516 Fix available EPSS 57.5% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 more Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service CVE-2019-9515 Fix available EPSS 87.3% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 more Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service CVE-2019-9514 Fix available EPSS 82.8% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service CVE-2019-9513 Public exploitFix available EPSS 81.6% 7.5 HighAugust 13, 2019
• apache traffic server, apple swiftnio, canonical ubuntu linux +17 more +19 more Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service CVE-2019-9511 Public exploitFix available EPSS 59.5% 7.5 HighAugust 13, 2019
• envoyproxy envoy, redhat openshift service mesh +1 more When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero... CVE-2019-9900 6.5 MediumApril 25, 2019