Skip to content

Vendor

linkerd vulnerabilities

3 published CVES affecting linkerd, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
1
Unscored
0
CISA KEV
1
Atom feed of linkerd alerts

Products

Latest linkerd CVEs

Newest publication first

  1. CVE-2025-43915 Linkerd resource exhaustion vulnerability

    Published
    MediumCVSS 6.5

    In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.

  2. CVE-2024-40632 Linkerd potential access to the shutdown endpoint

    Published
    LowCVSS 3.7

    Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/sh...

  3. CVE-2023-44487 HTTP/2 Stream Cancellation Attack

    Published
    HighCVSS 7.5 EPSS 100.0% CISA KEV added 2023-10-10 Exploited in the wild Public exploit PoC

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.