CVE-2025-0754

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-117

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-07557.5The various bson_append functions in the MongoDB C driver library may be susceptible to buffer overflow when performing operations that coul CVE-2025-07569.1Overview The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before CVE-2025-07574.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is us CVE-2025-07586.1Overview The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by CVE-2025-07593.3IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization CVE-2025-07602.7A Credential Disclosure vulnerability exists where an administrator could extract the stored SMTP account credentials due to lack of encrypt CVE-2025-07628.8Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2025-07634.3The Ultimate Classified Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-07646.5The wpForo Forum plugin for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'update' method of th CVE-2025-07654.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that CVE-2025-07679.8WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writer CVE-2025-07696.3PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an un