medium6.5
CVE-2025-43915
Linkerd resource exhaustion vulnerability
Impact
In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/linkerd/linkerd2 | < 0.0.0-20250212165942-faa3f617eef5 | 0.0.0-20250212165942-faa3f617eef5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linkerd | Buoyant | from 2.13.0 through 2.13.7 from 2.14.0 through 2.14.10 from 2.15.0 through 2.15.7 from 2.16.0 before 2.16.5 from 2.17.0 before 2.17.2 |
| Linkerd | Linkerd | before 25.2.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.buoyant.io/security/advisories/2025-01/
- https://www.buoyant.io/resources
- https://github.com/advisories/GHSA-42mr-jpwh-m9rv
- https://nvd.nist.gov/vuln/detail/CVE-2025-43915
- https://docs.buoyant.io/security/advisories/2025-01
- https://pkg.go.dev/vuln/GO-2025-3664