{"id":"CVE-2025-54470","revision":null,"records":[{"revision":"5740725d7138468283b92b3f280c6c42","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-54470","aliases":[],"title":"NeuVector telemetry sender is vulnerable to MITM and DoS","description":"This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.\n\n\nIn affected versions, NeuVector does not enforce TLS \ncertificate verification when transmitting anonymous cluster data to the\n telemetry server. As a result, the communication channel is susceptible\n to man-in-the-middle (MITM) attacks, where an attacker could intercept \nor modify the transmitted data. Additionally, NeuVector loads the \nresponse of the telemetry server is loaded into memory without size \nlimitation, which makes  it vulnerable to a Denial of Service(DoS) \nattack","state":0,"publishedAt":"2025-10-30T09:38:58.261+00:00","modifiedAt":"2025-10-30T14:01:08.513+00:00","affected":[{"ecosystem":"Vendor product","name":"https://github.com/neuvector/neuvector","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"https://github.com/neuvector/neuvector\",\n                    \"product\": \"neuvector\",\n                    \"vendor\": \"SUSE\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"5.3.5\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.3.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"5.4.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"5.4.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"0.0.0-20251020133207-084a437033b4\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.0.0-20230727023453-1c4957d53911\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":"HIGH"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470","https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-54470","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-54470","identifiers":["CVE-2025-54470"]},"retained":false,"historicalAffected":[]},{"revision":"18e49e1ac1db41d496ac1248820d1b6a","observedAt":"2026-11-11T03:32:50.102+00:00","statement":{"source":"euvd","id":"EUVD-2025-35220","aliases":["CVE-2025-54470","GHSA-qqj3-g7mx-5p4w"],"title":"This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.","description":"This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.\n\n\nIn affected versions, NeuVector does not enforce TLS \ncertificate verification when transmitting anonymous cluster data to the\n telemetry server. As a result, the communication channel is susceptible\n to man-in-the-middle (MITM) attacks, where an attacker could intercept \nor modify the transmitted data. Additionally, NeuVector loads the \nresponse of the telemetry server is loaded into memory without size \nlimitation, which makes  it vulnerable to a Denial of Service(DoS) \nattack","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":null}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470","https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35220","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 30, 2025, 9:38:58 AM","dateUpdated":"Oct 30, 2025, 2:01:08 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15710-1","title":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","vulnerabilityIds":["CVE-2016-11063","CVE-2016-11066","CVE-2016-11067","CVE-2016-11068","CVE-2016-11069","CVE-2016-11070","CVE-2016-11071","CVE-2016-11072","CVE-2016-11073","CVE-2016-11074","CVE-2016-11075","CVE-2016-11076","CVE-2016-11077","CVE-2016-11078","CVE-2016-11079","CVE-2016-11080","CVE-2016-11081","CVE-2016-11082","CVE-2016-11083","CVE-2016-11084","CVE-2017-18872","CVE-2023-32199","CVE-2024-58269","CVE-2025-10545","CVE-2025-10678","CVE-2025-10954","CVE-2025-11374","CVE-2025-11375","CVE-2025-11579","CVE-2025-11621","CVE-2025-12044","CVE-2025-26625","CVE-2025-27093","CVE-2025-41410","CVE-2025-41443","CVE-2025-54286","CVE-2025-54287","CVE-2025-54288","CVE-2025-54289","CVE-2025-54290","CVE-2025-54291","CVE-2025-54293","CVE-2025-54469","CVE-2025-54470","CVE-2025-54471","CVE-2025-54499","CVE-2025-58073","CVE-2025-58075","CVE-2025-58356","CVE-2025-59043","CVE-2025-59048","CVE-2025-59530","CVE-2025-59836","CVE-2025-59937","CVE-2025-61141","CVE-2025-61524","CVE-2025-61581","CVE-2025-61688","CVE-2025-62156","CVE-2025-62157","CVE-2025-62375","CVE-2025-62506","CVE-2025-62513","CVE-2025-62705","CVE-2025-62714","CVE-2025-62725","CVE-2025-62820","CVE-2025-64101","CVE-2025-64102","CVE-2025-64103"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-35220","identifiers":["EUVD-2025-35220","CVE-2025-54470","GHSA-qqj3-g7mx-5p4w"]},"retained":false,"historicalAffected":[]},{"revision":"0d8de0568d6f4e09972516241bac8e50","observedAt":"2026-10-25T02:25:06.051+00:00","statement":{"source":"nvd","id":"CVE-2025-54470","aliases":[],"title":"This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.","description":"This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server.\n\n\nIn affected versions, NeuVector does not enforce TLS \ncertificate verification when transmitting anonymous cluster data to the\n telemetry server. As a result, the communication channel is susceptible\n to man-in-the-middle (MITM) attacks, where an attacker could intercept \nor modify the transmitted data. Additionally, NeuVector loads the \nresponse of the telemetry server is loaded into memory without size \nlimitation, which makes  it vulnerable to a Denial of Service(DoS) \nattack","state":0,"publishedAt":"2025-10-30T10:15:35.257+00:00","modifiedAt":"2026-10-08T10:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · meissner@suse.de · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":"HIGH"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470","https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-54470","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-295"],"productCriteria":[],"sourceDates":{"published":"2025-10-30T10:15:35.257","lastModified":"2026-10-08T10:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-54470","identifiers":["CVE-2025-54470"]},"retained":false,"historicalAffected":[]},{"revision":"b4e7b728ba69455a952f33a4ec639e2d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-qqj3-g7mx-5p4w","aliases":["CVE-2025-54470","GO-2025-4044"],"title":"NeuVector telemetry sender is vulnerable to MITM and DoS","description":"### Impact\nThis vulnerability affects NeuVector deployments only when the `Report anonymous cluster data option` is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server at `https://upgrades.neuvector-upgrade-responder.livestock.rancher.io`.\n\nIn affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes  it vulnerable to a Denial of Service(DoS) attack. \n\nThe patched version includes the following security improvements:\n- NeuVector now verifies the telemetry server’s `TLS certificate chain` and `hostname` during the handshake process. This ensures that all telemetry communications occur over a trusted and verified channel.\n- NeuVector limits the telemetry server’s response to `256 bytes`, mitigating the risk of memory exhaustion and DoS attacks.\n\nThese security enhancements are enabled by default and require no user action.\n\n\n### Patches\nPatched versions include release **v5.4.7** and above.\n\n### Workarounds\nIf you cannot update to a patched version, you can temporarily disable the Report anonymous cluster data, which is enabled by default in NeuVector.\nTo change this setting, go to **Settings** → **Configuration** → **Report anonymous cluster data** in the NeuVector UI.\n\nDisabling this option prevents NeuVector from sending telemetry data to the telemetry server, which helps mitigate this vulnerability.\n\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).","state":0,"publishedAt":"2025-10-21T20:25:21+00:00","modifiedAt":"2026-09-10T03:50:30.1741665+00:00","affected":[{"ecosystem":"Go","name":"github.com/neuvector/neuvector","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-20230727023453-1c4957d53911"},{"kind":"fixed","version":"0.0.0-20251020133207-084a437033b4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w","https://nvd.nist.gov/vuln/detail/CVE-2025-54470","https://github.com/neuvector/neuvector/commit/06424701e69bf1eb76ff90180d78853fded93021","https://github.com/neuvector/neuvector/commit/415737cbec581a5dc5f204fac1c78b7f29ad7dc2","https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470","https://github.com/neuvector/neuvector"],"sourceUrl":"https://github.com/advisories/GHSA-qqj3-g7mx-5p4w","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qqj3-g7mx-5p4w","identifiers":["GHSA-qqj3-g7mx-5p4w","CVE-2025-54470","GO-2025-4044"]},"retained":false,"historicalAffected":[]},{"revision":"12f6c457591a440a8bbc344428dfcc78","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4044","aliases":["CVE-2025-54470","GHSA-qqj3-g7mx-5p4w"],"title":"NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector","description":"NeuVector telemetry sender is vulnerable to MITM and DoS in github.com/neuvector/neuvector","state":0,"publishedAt":"2025-10-30T15:02:47+00:00","modifiedAt":"2026-07-01T12:48:19.7295622+00:00","affected":[{"ecosystem":"Go","name":"github.com/neuvector/neuvector","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w","https://github.com/neuvector/neuvector/commit/06424701e69bf1eb76ff90180d78853fded93021","https://github.com/neuvector/neuvector/commit/415737cbec581a5dc5f204fac1c78b7f29ad7dc2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4044","license":"OSV · upstream source license applies","key":"osv:GO-2025-4044","identifiers":["GO-2025-4044","CVE-2025-54470","GHSA-qqj3-g7mx-5p4w"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:46.3036784+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:46.3038639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-f19af5e22c13aa688d23829fe96c281d0deaf6cf2f8cee6748f54f5a479127b2","complete":true,"records":424021,"lastAttemptAt":"2026-11-11T09:57:38.9264743+00:00","lastSuccessAt":"2026-11-11T09:25:54.5258746+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:38.9264743+00:00","snapshotPublishedAt":"2026-11-11T09:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f581ef223ba240a69a1abcff00ee4876","complete":true,"records":13758,"lastAttemptAt":"2026-11-11T09:58:42.1822037+00:00","lastSuccessAt":"2026-11-11T09:58:42.065+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:58:42.065+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T09:57:43.3267414+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T09:57:43.3267414+00:00","lastSuccessAt":"2026-11-11T09:57:52.273871+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:52.273872+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-304fa97221904da4b3dcd306fc4b8a4b","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T09:57:53.9573384+00:00","lastSuccessAt":"2026-11-11T09:26:01.454+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:26:01.454+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T09:57:42.4406155+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:42.4406155+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T09:57:39.9639043+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:39.9639043+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-2bc186fc4a8179fd66d765079d475b0b8e3af9f89b57dcc310e7773ded48b2cc","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T09:57:43.196106+00:00","lastSuccessAt":"2026-11-11T09:25:59.9234294+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:43.196106+00:00","snapshotPublishedAt":"2026-11-11T09:02:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T09:57:41.7897107+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T09:57:41.7897107+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}