CVE-2025-2586
High
Description
A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.
SeverityHigh
CVSS7.5
Exploit probability—
ProductLightspeed-service
PublishedMar 31, 2025
First seenMar 31, 2025
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- lightspeed-service88f9dc91856593d878b60ad9a67ffee8d4621ba5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lightspeed-service | v < 88f9dc91856593d878b60ad9a67ffee8d4621ba5 | 88f9dc91856593d878b60ad9a67ffee8d4621ba5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.