ByteOS Network

Vulnerability Details :

CVE-2025-43915

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-05 May, 2025 | 00:00

Updated At-19 May, 2025 | 15:10

In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:05 May, 2025 | 00:00

Updated At:19 May, 2025 | 15:10

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://www.buoyant.io/resources	N/A
https://docs.buoyant.io/security/advisories/2025-01/	N/A

Hyperlink: https://www.buoyant.io/resources

Resource: N/A

Hyperlink: https://docs.buoyant.io/security/advisories/2025-01/

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-400	CWE-400 Uncontrolled Resource Consumption

Type: CWE

CWE ID: CWE-400

Description: CWE-400 Uncontrolled Resource Consumption

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:05 May, 2025 | 17:18

Updated At:17 Jun, 2025 | 14:12

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

CPE Matches

linkerd>>buoyant>>Versions from 2.13.0(inclusive) to 2.13.7(inclusive)

cpe:2.3:a:linkerd:buoyant:*:*:*:*:enterprise:linkerd:*:*

linkerd>>buoyant>>Versions from 2.14.0(inclusive) to 2.14.10(inclusive)

cpe:2.3:a:linkerd:buoyant:*:*:*:*:enterprise:linkerd:*:*

linkerd>>buoyant>>Versions from 2.15.0(inclusive) to 2.15.7(inclusive)

cpe:2.3:a:linkerd:buoyant:*:*:*:*:enterprise:linkerd:*:*

linkerd>>buoyant>>Versions from 2.16.0(inclusive) to 2.16.5(exclusive)

cpe:2.3:a:linkerd:buoyant:*:*:*:*:enterprise:linkerd:*:*

linkerd>>buoyant>>Versions from 2.17.0(inclusive) to 2.17.2(exclusive)

cpe:2.3:a:linkerd:buoyant:*:*:*:*:enterprise:linkerd:*:*

linkerd>>linkerd>>Versions before 25.2.1(exclusive)

cpe:2.3:a:linkerd:linkerd:*:*:*:*:edge:kubernetes:*:*

Weaknesses

CWE ID	Type	Source
CWE-400	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-400

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://docs.buoyant.io/security/advisories/2025-01/	cve@mitre.org	Vendor Advisory
https://www.buoyant.io/resources	cve@mitre.org	Product

Hyperlink: https://docs.buoyant.io/security/advisories/2025-01/

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://www.buoyant.io/resources

Source: cve@mitre.org

Resource:

Product

Similar CVEs

1Records found

CVE-2023-44487

Matching Score-6

Assigner-MITRE Corporation

View Details

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-100.00% / 100.00%

7 Day CHG~0.00%

Published-10 Oct, 2023 | 00:00

Updated-14 Jul, 2026 | 12:03

Known KEV||Action Due Date - 2023-10-31||Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Product-nexus_9804 nexus_9332d-h2r nexus_9372tx nexus_9200 istio nexus_92160yc_switch fedora nexus_92160yc-x siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware enterprise_chat_and_email .net visual_studio_2022 windows_10_22h2 node_healthcheck_operator nexus_36180yc-r openshift_sandboxed_containers nexus_9500_4-slot nexus_93128tx_switch nexus_92300yc big-ip_next cost_management jboss_enterprise_application_platform nexus_9200yc nexus_9332pq nexus_9396tx proxygen ultra_cloud_core_-_session_management_function integration_camel_k integration_camel_for_spring_boot nexus_3064t azure_kubernetes_service nexus_93180yc-fx crosswork_zero_touch_provisioning big-ip_analytics nexus_3432d-s nexus_93180yc-fx3 secure_malware_analytics opensearch_data_prepper secure_web_appliance_firmware web_terminal prime_infrastructure nexus_93180lc-ex_switch openshift_container_platform_assisted_installer certification_for_red_hat_enterprise_linux prime_cable_provisioning nexus_93108tc-fx-24 connected_mobile_experiences nexus_92300yc_switch process_automation expressway http_server unified_attendant_console_advanced openstack_platform nginx_plus nexus_93240yc-fx2 nexus_3636c-r cryostat nexus_3100-z single_sign-on openshift_distributed_tracing nexus_9736pq nexus_9272q nexus_3016q nexus_93108tc-ex-24 unified_contact_center_domain_manager nexus_9396tx_switch openshift_developer_tools_and_services nexus_93128 crosswork_situation_manager nexus_93180yc-ex-24 nexus_9332pq_switch windows_server_2022 nexus_31108pc-v openshift_api_for_data_protection openshift_gitops nexus_3132c-z support_for_spring_boot windows_server_2016 nexus_3016 nexus_3132q-v openshift_service_mesh 3scale_api_management_platform nexus_3464c nexus_9500r openshift caddy nexus_3100-v nexus_3132q openshift_secondary_scheduler_operator nexus_3064-32t nexus_31108tc-v armeria go migration_toolkit_for_containers build_of_optaplanner nexus_3232 nexus_9372px big-ip_websafe nexus_9500_supervisor_a nexus_9348gc-fxp ultra_cloud_core_-_serving_gateway_function nexus_3172tq nexus_9504 windows_10_21h2 nexus_3064x nexus_3232c nexus_9636pq nexus_3400 jetty ansible_automation_platform nexus_9500_supervisor_b nexus_9372tx-e windows_10_1809 nexus_3524-xl nexus_3408-s nexus_3172tq-32t nexus_93180tc-ex nexus_9516 nexus_3524-x nexus_3264c-e nexus_3172pq nexus_3172pq\/pq-xl nexus_9336pq astra_control_center nexus_9364c-gx nexus_9336c-fx2 simatic_s7-1500_cpu_1518-4_pn\/dp nexus_9236c nexus_9536pq nexus_9236c_switch nexus_93180yc-fx-24 nexus_31128pq network_observability_operator big-ip_application_security_manager prime_access_registrar swiftnio_http\/2 linkerd ios_xe windows_11_22h2 nexus_9500_supervisor_b\+nexus_9364d-gx2a decision_manager big-ip_policy_enforcement_manager quay nexus_3264q business_process_automation nexus_3100v secure_dynamic_attributes_connector nexus_9372tx_switch nexus_9500_supervisor_a\+machine_deletion_remediation_operator node.js satellite nexus_9348d-gx2a big-ip_domain_name_system nexus_3064 nexus_9372px-e_switch big-ip_link_controller nexus_93108tc-ex_switch http big-ip_advanced_firewall_manager prime_network_registrar cert-manager_operator_for_red_hat_openshift nexus_9432pq traefik build_of_quarkus nexus_3524 self_node_remediation_operator crosswork_data_gateway contour node_maintenance_operator cbl-mariner nexus_9716d-gx sinec_ins h2o nexus_9332d-gx2b nexus_9372px_switch apisix jboss_core_services nexus_9500_16-slot simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware oncommand_insight nexus_9372px-e nexus_9336pq_aci_spine nexus_3548-x nexus_9221c nexus_9272q_switch nexus_93108tc-fx firepower_threat_defense big-ip_fraud_protection_service windows_server_2019 migration_toolkit_for_virtualization varnish_cache unified_contact_center_enterprise nexus_93108tc-fx3h nexus_93240tc-fx2 asp.net_core telepresence_video_communication_server nexus_93216tc-fx2 nexus_3100 traffic_server nexus_3064-x nexus_9348gc-fx3 nexus_9332c big-ip_application_visibility_and_reporting nexus_3132q-x\/3132q-xl tomcat windows_10_1607 simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware nexus_3172tq-xl nexus_3548-xl nexus_9336pq_aci_spine_switch siplus_s7-1500_cpu_1518-4_pn\/dp_mfp nexus_3164q debian_linux nexus_9396px_switch nexus_9396px logging_subsystem_for_red_hat_openshift nexus_9364c big-ip_webaccelerator openshift_serverless networking nexus_9500 big-ip_ssl_orchestrator nexus_93180yc-ex_switch nexus_9508 nexus_3132q-x nexus_93120tx nexus_3132q-xl nexus_9408 ruggedcom_ape1808_firmware nexus_34180yc nexus_93180yc-fx3s nx-os nexus_93180lc-ex unified_contact_center_management_portal nexus_92304qc_switch data_center_network_manager openresty nexus_92348gc-x big-ip_application_acceleration_manager openshift_virtualization nexus_93108tc-fx3p nexus_93360yc-fx2 nexus_3172pq-xl nexus_31108pv-v grpc nexus_93128tx nexus_3064-t advanced_cluster_management_for_kubernetes big-ip_advanced_web_application_firewall envoy nexus_3232c_big-ip_global_traffic_manager nginx fence_agents_remediation_operator jboss_data_grid ios_xr fog_director simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp big-ip_carrier-grade_nat nexus_9300 windows_11_21h2 secure_web_appliance integration_service_registry http2 openshift_dev_spaces big-ip_ddos_hybrid_defender nexus_93180yc-fx3h service_interconnect nghttp2 openshift_data_science st7_scadaconnect nexus_93120tx_switch big-ip_local_traffic_manager big-ip_access_policy_manager jboss_fuse openshift_container_platform openshift_pipelines nexus_3048 nexus_9508_switch netty nexus_9336c-fx2-e nexus_93600cd-gx nexus_34200yc-sm nexus_9516_switch ceph_storage nexus_3600 jboss_a-mq run_once_duration_override_operator nexus_9000v nexus_3172 nexus_3500 sinec_nms ruggedcom_ape1808 nexus_9336pq_aci nexus_9316d-gx nexus_9800 kong_gateway advanced_cluster_security nexus_3548-x\/xl unified_contact_center_enterprise_-_live_data_server ultra_cloud_core_-_policy_control_function big-ip_next_service_proxy_for_kubernetes nexus_9232e nexus_9808 jboss_a-mq_streams nexus_92304qc iot_field_network_director nexus_9500_8-slot migration_toolkit_for_applications nexus_3200 solr jenkins nginx_ingress_controller nexus_93180yc-ex nexus_9372tx-e_switch nexus_93108tc-ex nexus_9504_switch nexus_3524-x\/xl nexus_3548 service_telemetry_framework enterprise_linux n/a http SIPLUS S7-1500 CPU 1518-4 PN/DP MFP SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP SIMATIC S7-1500 CPU 1518-4 PN/DP MFP SINEC NMS RUGGEDCOM APE1808 HTTP/2

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2025-43915

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs