CVE-2025-2586highCWE-400

CVE-2025-2586: fallo de gravedad alta en Red Hat OpenShift Lightspeed

Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustion

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear OpenShift Lightspeed+ Monitorear lightspeed-service

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.6%
A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
lightspeed-serviceRed Hat · OpenShift Lightspeed
CVEs relacionadas — Red Hat OpenShift Lightspeed

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2026-114236LOWPodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layersEPSS 0.1%