Openshift Service Mesh

Vendor:

First CVE: Apr 25, 2019 · Active for 7 years

22

Total CVEs

More Total CVEs than 95% of tracked products

3.1

Avg CVEs / Year

Higher CVE frequency than 84% of tracked products

7.7

Avg CVSS

Higher Avg CVSS than 64% of tracked products

4.5%

KEV Rate

Higher KEV Rate than 98% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Openshift Service Mesh over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 25, 2019

7 years ago

Most Recent CVE

Jun 17, 2026

40 days ago

CVE Severity & Scoring

Openshift Service Mesh22 CVEs

14%

77%

9%

All CVEs352,785 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local1 (4.5%)

Network21 (95.5%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low22 (100.0%)

High0 (0.0%)

Unknown0 (0.0%)

User Interaction

None21 (95.5%)

Unknown0 (0.0%)

Required1 (4.5%)

Privileges Required

Low5 (22.7%)

High0 (0.0%)

None17 (77.3%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (22 CVEs).

22 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through	Oct 10, 2023	7.5	97	YES	YES
CVE-2019-9515HIGH Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RF	Aug 13, 2019	7.5	66	NO	NO
CVE-2019-9514HIGH Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over ea	Aug 13, 2019	7.5	65	NO	NO
CVE-2019-9513HIGH Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the	Aug 13, 2019	7.5	65	NO	NO
CVE-2019-9511HIGH Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a l	Aug 13, 2019	7.5	52	NO	NO
CVE-2019-9516MEDIUM Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-le	Aug 13, 2019	6.5	44	NO	NO
CVE-2026-47774HIGH Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability in Envoy's HTTP/2 down	Jun 17, 2026	7.5	33	NO	NO
CVE-2020-27846CRITICAL A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confiden	Dec 21, 2020	9.8	32	NO	NO
CVE-2019-9517HIGH Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can	Aug 13, 2019	7.5	31	NO	NO
CVE-2021-3586CRITICAL A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on the	Aug 22, 2022	9.8	30	NO	NO

View all 22 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (22 CVEs).

CISA KEV

1 CVE

4.5% of CVEs· 98th percentile

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

4.5% of CVEs· 86th percentile

Social Chatter

Signals from CVEs in this product scope (22 CVEs).

Media Mentions

Signals from CVEs in this product scope (22 CVEs).

Top CNAs Publishing CVEs For Openshift Service Mesh

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	KEV	Exploits
2.6.3	1	7.1	0.4%	0	0
2.5.6	1	7.1	0.4%	0	0
2.3.1	1	4.3	0.7%	0	0
2.0	4	9.0	26.7%	1	1
1.0.9	1	7.5	1.9%	0	0
1.0	13	7.6	33.3%	0	0