OS
Product
Openshift Service Mesh
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 17Medium 3Low 0
Watch
Add Openshift Service Mesh to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3586 | 9.8 | Aug 22 | A flaw was found in servicemesh-operator Affected: 2.0 |
| CVE-2020-27846 | 9.8 | Dec 21 | A signature verification vulnerability exists in crewjam/saml Affected: 2.0 |
| CVE-2021-3495 | 8.8 | Jun 1 | An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7 Affected: 1.0; 2.0 |
| CVE-2020-1762 | 8.6 | Apr 27 | An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by… Affected: 1.0 |
| CVE-2020-1764 | 8.6 | Mar 26 | A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1 Affected: 1.0 |
| CVE-2019-9900 | 8.3 | Apr 25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0) Affected: All versions, or not specified |
| CVE-2020-1704 | 7.8 | Feb 17 | An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the… Affected: before 1.0.8 |
| CVE-2026-44495 | 7.7 | Jun 11 | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge Affected: All versions, or not specified |
| CVE-2026-47774 | 7.5 | Jun 17 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification Affected: 2.6 before 2.6.17; 3.0 before 3.0.12; 3.1 before 3.1.9; 3.2 before 3.2.6; 3.3 before 3.3.4 |
| CVE-2020-8661 | 7.5 | Mar 4 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests Affected: 1.0.9 |
| CVE-2020-8659 | 7.5 | Mar 4 | CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e Affected: 1.0 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 1.0 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 1.0 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 1.0 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 1.0 |
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 1.0 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 1.0 |
| CVE-2020-8595 | 7.3 | Feb 12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass Affected: 1.0 |
| CVE-2025-0752 | 7.1 | Jan 28 | A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6 Affected: 2.5.6; 2.6.3 |
| CVE-2019-25014 | 6.5 | Jan 29 | A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0 Affected: 1.0 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 1.0 |
| CVE-2022-3962 | 4.3 | Sep 23 | A content spoofing vulnerability was found in Kiali Affected: 2.3.1 |
Showing 22