Answer in brief
CVE-2025-2586 records a High severity (CVSS 7.5) vulnerability in Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustion. The current sources do not mark it as known exploited. The current feed maps lightspeed-service (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps lightspeed-service (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| lightspeed-servicegeneric | >=0 <88f9dc91856593d878b60ad9a67ffee8d4621ba5 | 88f9dc91856593d878b60ad9a67ffee8d4621ba5 |
Published upstream
Mar 31, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
A flaw was found in the OpenShift Lightspeed Service, which is vulnerable to unauthenticated API request flooding. Repeated queries to non-existent endpoints inflate metrics storage and processing, consuming excessive resources. This issue can lead to monitoring system degradation, increased disk usage, and potential service unavailability. Since the issue does not require authentication, an external attacker can exhaust CPU, RAM, and disk space, impacting both application and cluster stability.
Quoted source text, attributed separately from HOL analysis.