Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustion
A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.
CVE-2025-2586
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-2586
OpenShift Lightspeed
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "88f9dc91856593d878b60ad9a67ffee8d4621ba5",
"versionType": "git"
}
],
"packageName": "lightspeed-service",
"collectionURL": "https://github.com/openshift/lightspeed-service",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_lightspeed:1"
],
"vendor": "Red Hat",
"product": "OpenShift Lightspeed",
"packageName": "openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-2586
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #28667 · Revision 1
- Added to Heist Feed
- Publisher date