CVE-2025-0754 Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "2.6.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "2.5.6",
        "versionType": "semver"
      }
    ],
    "packageName": "envoyproxy",
    "collectionURL": "https://github.com/openshift-service-mesh/proxy",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "OpenShift Service Mesh 2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openshift-service-mesh/proxyv2-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:service_mesh:2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "OpenShift Service Mesh 2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openshift-service-mesh/proxyv2-rhel9",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:service_mesh:2"
    ]
  }
]