CVE-2025-43915: 
vulnerability analysis and mitigation

CVE-2025-43915 affects Linkerd proxy metrics in Buoyant Edge and Enterprise releases. The vulnerability was disclosed on May 5, 2025, and impacts Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1. The issue involves resource exhaustion that can occur for Linkerd proxy metrics (Wiz Report, NVD).

The vulnerability occurs when Linkerd proxies track and provide metrics for workload's inbound and outbound HTTP requests. Inbound request metrics include an authority label, and outbound request metrics include a hostname label. When proxies receive requests with a large number of unique hostnames, they may exhibit high cardinality of metrics data, potentially consuming excessive proxy memory and overwhelming metrics ingestion infrastructure. The vulnerability has been assigned a CVSS v3.1 Temporal Score of 5.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:P/RL:O/RC:C and is categorized under CWE-770: Allocation of Resources Without Limits or Throttling (Buoyant Advisory).

The vulnerability can lead to increased proxy memory consumption over time, potentially overwhelming metrics ingestion infrastructure and creating undesirable costs for third-party metrics ingestors. This particularly affects Linkerd deployments exposed to the Internet through meshed ingress controllers, deployments taking requests from arbitrary third-party applications, and deployments that mesh arbitrary third-party applications with egress metrics enabled (Buoyant Advisory).

Users should ensure Linkerd proxies are not exposed to HTTP requests containing an unbounded number of unique hostnames. For Internet-facing workloads, HTTP requests should be filtered before reaching the Linkerd proxy. Users should update to edge-25.2.1 or later for edge releases, or to BEL releases 2.16.5, 2.17.2, 2.18.0, or later releases for Buoyant Enterprise for Linkerd. The updated versions disable these metric labels by default (Buoyant Advisory).