CVE-2025-54470: NeuVector Telemetry DoS Vulnerability

CVE-2025-54470 Overview

CVE-2025-54470 is a high-severity vulnerability in NeuVector, an open source container security platform maintained by SUSE. The flaw affects deployments where the Report anonymous cluster data option is enabled. NeuVector fails to enforce Transport Layer Security (TLS) certificate verification when sending telemetry data to its remote server. The platform also loads server responses into memory without size limits. Attackers positioned on the network can intercept or modify telemetry traffic and trigger denial of service through oversized responses. The weakness is tracked as CWE-295: Improper Certificate Validation.

Critical Impact

Network-positioned attackers can intercept telemetry data through man-in-the-middle attacks and crash NeuVector deployments by returning unbounded responses to telemetry requests.

Affected Products

• NeuVector container security platform (versions prior to the patched release)
• Deployments with Report anonymous cluster data telemetry option enabled
• SUSE-distributed NeuVector packages

Discovery Timeline

• 2025-10-30 - CVE-2025-54470 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54470

Vulnerability Analysis

The vulnerability has two distinct components, both rooted in the telemetry client implementation. First, NeuVector establishes outbound HTTPS connections to its telemetry endpoint without validating the server certificate chain. This breaks the trust model that TLS is designed to provide. Second, the client reads the entire HTTP response body into memory with no maximum length enforcement. A crafted response can exhaust available memory in the NeuVector controller process.

The two issues compound each other. An attacker who can intercept the TLS session can also choose to deliver a malicious payload designed to trigger the memory exhaustion path. This converts a passive eavesdropping primitive into an active service disruption capability.

Root Cause

The root cause is missing certificate verification logic in the telemetry HTTPS client, combined with the absence of a Content-Length cap or streaming read limit when consuming the response body. Both are configuration omissions in the Go HTTP client setup used to contact the telemetry server.

Attack Vector

Exploitation requires the attacker to be on a network path between the NeuVector controller and the telemetry server. This includes upstream ISPs, compromised egress proxies, DNS hijackers, or attackers in shared cloud network segments. No authentication or user interaction is required. Once positioned, the attacker presents any TLS certificate, terminates the connection, and either reads the cluster telemetry payload or returns a multi-gigabyte response to crash the controller.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-qqj3-g7mx-5p4w and the SUSE Bug Report CVE-2025-54470. No public proof-of-concept code has been released.

Detection Methods for CVE-2025-54470

Indicators of Compromise

• Outbound TLS connections from NeuVector controllers terminating at unexpected IP addresses or autonomous systems
• NeuVector controller pods restarting with out-of-memory (OOM) kill events in Kubernetes logs
• Anomalously large HTTP response sizes recorded in egress proxy logs for telemetry destinations

Detection Strategies

• Inspect egress traffic from NeuVector controller pods and validate that telemetry destinations resolve to legitimate SUSE infrastructure
• Monitor Kubernetes events for repeated OOMKilled status on NeuVector controller pods correlated with telemetry intervals
• Audit NeuVector configuration for the Report anonymous cluster data setting across all clusters

Monitoring Recommendations

• Enable network flow logging on cluster egress points and alert on TLS connections that fail strict certificate pinning
• Track memory consumption metrics for NeuVector controller workloads and alert on sudden growth patterns
• Review SIEM logs for outbound connections from container security tooling to non-allowlisted endpoints

How to Mitigate CVE-2025-54470

Immediate Actions Required

• Disable the Report anonymous cluster data option in NeuVector until patches are applied
• Upgrade NeuVector to the fixed release identified in the GitHub Security Advisory GHSA-qqj3-g7mx-5p4w
• Restrict egress traffic from NeuVector controllers to known telemetry endpoints only

Patch Information

SUSE and the NeuVector project have published fixes that enforce TLS certificate verification on the telemetry client and impose a maximum response body size. Upgrade details are documented in the SUSE Bug Report CVE-2025-54470 and the upstream advisory. Apply the patched container image across all controller replicas.

Workarounds

• Disable telemetry reporting entirely by turning off Report anonymous cluster data in the NeuVector console
• Route NeuVector egress through an authenticated proxy that performs certificate validation on behalf of the client
• Apply Kubernetes NetworkPolicy rules to limit controller egress to verified telemetry hostnames

# Disable telemetry via NeuVector configuration
# Navigate: Settings > Configuration > Report anonymous cluster data = OFF

# Example NetworkPolicy restricting NeuVector controller egress
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: neuvector-controller-egress
  namespace: neuvector
spec:
  podSelector:
    matchLabels:
      app: neuvector-controller-pod
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: TCP
          port: 443
EOF