GHSA-42mr-jpwh-m9rv

Linkerd resource exhaustion vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-43915

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/linkerd/linkerd2	< 0.0.0-20250212165942-faa3f617eef5	0.0.0-20250212165942-faa3f617eef5

Details

As written in the advisory (Markdown source, shown as plain text).

In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-43915 advisory
https://docs.buoyant.io/security/advisories/2025-01 web
https://github.com/linkerd/linkerd2 package
https://pkg.go.dev/vuln/GO-2025-3664 web
https://www.buoyant.io/resources web