RHSA-2026:2147

Vulnerability from csaf_redhat - Published: 2026-02-05 15:58 - Updated: 2026-02-05 20:07
Summary
Red Hat Security Advisory: Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0

Notes

Topic
Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kiali 2.4.12, for Red Hat OpenShift Service Mesh 3.0, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently Security Fix(es): * kiali-ossmc-rhel9: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) * kiali-rhel9: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) * kiali-rhel9: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729) * kiali-ossmc-rhel9: React Router vulnerable to XSS via Open Redirects (CVE-2026-22029) * kiali-rhel9: React Router vulnerable to XSS via Open Redirects (CVE-2026-22029) * kiali-ossmc-rhel9: prototype pollution in _.unset and _.omit functions (CVE-2025-13465) * kiali-rhel9: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 2.4.12, for Red Hat OpenShift Service Mesh 3.0, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently\n\nSecurity Fix(es):\n\n* kiali-ossmc-rhel9: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* kiali-rhel9: qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284)\n\n* kiali-rhel9: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729)\n\n* kiali-ossmc-rhel9: React Router vulnerable to XSS via Open Redirects (CVE-2026-22029)\n\n* kiali-rhel9: React Router vulnerable to XSS via Open Redirects (CVE-2026-22029)\n\n* kiali-ossmc-rhel9: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)\n\n* kiali-rhel9: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2147",
        "url": "https://access.redhat.com/errata/RHSA-2026:2147"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-13465",
        "url": "https://access.redhat.com/security/cve/CVE-2025-13465"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15284",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15284"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-22029",
        "url": "https://access.redhat.com/security/cve/CVE-2026-22029"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/cve-2025-13465",
        "url": "https://access.redhat.com/security/cve/cve-2025-13465"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/cve-2025-15284",
        "url": "https://access.redhat.com/security/cve/cve-2025-15284"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/cve-2025-61729",
        "url": "https://access.redhat.com/security/cve/cve-2025-61729"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/cve-2026-22029",
        "url": "https://access.redhat.com/security/cve/cve-2026-22029"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2147.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 2.4.12 for Red Hat OpenShift Service Mesh 3.0",
    "tracking": {
      "current_release_date": "2026-02-05T20:07:14+00:00",
      "generator": {
        "date": "2026-02-05T20:07:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2026:2147",
      "initial_release_date": "2026-02-05T15:58:12+00:00",
      "revision_history": [
        {
          "date": "2026-02-05T15:58:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-05T15:58:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-05T20:07:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.0",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.0",
                  "product_id": "Red Hat OpenShift Service Mesh 3.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Ad188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140853"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ad843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140791"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Aada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140853"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140791"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140853"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ac1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140791"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140853"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1770140791"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64 as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64 as a component of Red Hat OpenShift Service Mesh 3.0",
          "product_id": "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13465",
      "cwe": {
        "id": "CWE-1321",
        "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
      },
      "discovery_date": "2026-01-21T20:01:28.774829+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2431740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: prototype pollution in _.unset and _.omit functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable by applications using the _.unset and _.omit functions on an object and allowing user input to determine the path of the property to be removed. This issue only allows the deletion of properties but does not allow overwriting their behavior, limiting the impact to a denial of service. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "RHBZ#2431740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-13465",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
          "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"
        }
      ],
      "release_date": "2026-01-21T19:05:28.846000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T15:58:12+00:00",
          "details": "See Kiali 2.4.12 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2147"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: prototype pollution in _.unset and _.omit functions"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-29T23:00:58.541337+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425946"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qs: qs: Denial of Service via improper input validation in array parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425946",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
          "url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
        }
      ],
      "release_date": "2025-12-29T22:56:45.240000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T15:58:12+00:00",
          "details": "See Kiali 2.4.12 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2147"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qs: qs: Denial of Service via improper input validation in array parsing"
    },
    {
      "cve": "CVE-2025-61729",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2025-12-02T20:01:45.330964+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2418462"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "RHBZ#2418462",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/725920",
          "url": "https://go.dev/cl/725920"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/76445",
          "url": "https://go.dev/issue/76445"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
          "url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-4155",
          "url": "https://pkg.go.dev/vuln/GO-2025-4155"
        }
      ],
      "release_date": "2025-12-02T18:54:10.166000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T15:58:12+00:00",
          "details": "See Kiali 2.4.12 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
    },
    {
      "cve": "CVE-2026-22029",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-01-10T04:01:03.694749+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2428412"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "React Router is a router for React. In @remix-run/router version prior to 1.23.2. and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect. There is no impact if Declarative Mode (\u003cBrowserRouter\u003e) is being used. This issue has been patched in @remix-run/router version 1.23.2 and react-router version 7.12.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
          "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-22029"
        },
        {
          "category": "external",
          "summary": "RHBZ#2428412",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428412"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-22029",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-22029"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22029",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22029"
        },
        {
          "category": "external",
          "summary": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx",
          "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-2w69-qvjg-hvjx"
        }
      ],
      "release_date": "2026-01-10T02:42:32.736000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-05T15:58:12+00:00",
          "details": "See Kiali 2.4.12 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2147"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:19c44dfb277123122abafc25552fe408ea7ad6dc026aa592f53e3a754ca0a44f_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:94fc56d838f03fd43cacfc219626464469fae9ebf24e10a6b2e3de710d9da268_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c1db580dd0b4417b069cf8bc9d691047e7b31406fd75075e1e63df6ba5f1799e_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:d843214da448c340907b3eee5fb95ed6937b61897c2d3d7d54f0aad1f7423a9d_amd64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:527fd434b3b1f9b9304adbedd89a593ca347a84571a68c7935afe6aa207db49f_s390x",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6300ec1cc673e8eb40333fe98e69845c995116a5c4c80cf37f78209fc3ad1883_ppc64le",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ada195cbb75fa307fbbc82856a34991d6e88b39be01d2b0b38a4be77e1c80ebd_arm64",
            "Red Hat OpenShift Service Mesh 3.0:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:d188f4e95efbc9c699975ac101a746ee2ccf0313e8b6ef2834c36540ffee9b34_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "@remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.