What’s Vulnerable › Products
Red Hat OpenShift Service Mesh 2 vulnerabilities
26 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Check whether your Red Hat OpenShift Service Mesh 2 version is affected
Exploited Red Hat OpenShift Service Mesh 2 vulnerabilities
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
Latest Red Hat OpenShift Service Mesh 2 vulnerabilities
- CVE-2026-47774 — Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplification (CVSS 7.5)
- CVE-2026-44495 — Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.7)
- CVE-2026-29063 — Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable (CVSS 9.8)
- CVE-2024-11831 — Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript (CVSS 5.4)
- CVE-2025-0754 — Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing (CVSS 4.3)
- CVE-2025-0752 — Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access (CVSS 7.1)
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
- CVE-2022-3962 — Kiali: error message spoofing in kiali ui (CVSS 4.3)
- CVE-2021-3586 — (CVSS 9.8)
- CVE-2021-3495 — (CVSS 8.8)
- CVE-2019-25014 — (CVSS 6.5)
- CVE-2020-27846 — (CVSS 9.8)
- CVE-2020-1762 — (CVSS 8.6)
- CVE-2020-1764 — (CVSS 8.6)
- CVE-2020-8661 — (CVSS 7.5)
- CVE-2020-8659 — (CVSS 7.5)
- CVE-2020-1704 — (CVSS 7.8)
- CVE-2020-8595 — (CVSS 7.3)
- CVE-2019-9518 — Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service (CVSS 7.5)
- CVE-2019-9517 — Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service (CVSS 7.5)
- CVE-2019-9516 — Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service (CVSS 6.5)
- CVE-2019-9515 — Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service (CVSS 7.5)
- CVE-2019-9514 — Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service (CVSS 7.5)
- CVE-2019-9513 — Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service (CVSS 7.5)
- CVE-2019-9511 — Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (CVSS 7.5)