PT-2025-13692 · Red Hat · Openshift Lightspeed Service

Published 2025-03-31 · Updated 2025-04-04 · CVE-2025-2586

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenShift Lightspeed Service (affected versions not specified)

Description A flaw in the OpenShift Lightspeed Service makes it vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints, such as /api/v1/nonexistent, inflate metrics storage and processing, consuming excessive resources. This can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-2586

Affected Products

Openshift Lightspeed Service

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-2586 · Security Note
• https://twitter.com/Carlos_LopezMkt/status/1907751359601873091 · Twitter Post
• https://twitter.com/cybercronai/status/1906708730336399661 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-2586 · Note
• https://twitter.com/AyushInfo57268/status/1906688822139842617 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2353998 · Note
• https://twitter.com/cracbot/status/1908112427549409439 · Twitter Post
• https://twitter.com/GABBYTECH_SEC/status/1906820996184821906 · Twitter Post
• https://twitter.com/vulns_space/status/1906685430050824685 · Twitter Post
• https://t.me/cvedetector/21581 · Telegram Post
• https://twitter.com/CVEnew/status/1906675433266987394 · Twitter Post
• https://twitter.com/Gabriel_coder01/status/1906816022507610601 · Twitter Post
• https://twitter.com/cracbot/status/1907750035259011208 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1906693875424526715 · Twitter Post