RHSA-2026:49735
Vulnerability from csaf_redhat - Published: 2026-08-03 17:11 - Updated: 2026-08-05 18:46Summary
Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4
Severity
Important
Notes
Topic: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4 is now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.27.2, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-49978 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15013)
* CVE-2026-49978 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15016)
* CVE-2026-59877 openshift-service-mesh/kiali-ossmc-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15029)
* CVE-2026-59877 openshift-service-mesh/kiali-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15030)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.
8.1 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le | — |
Threats
Impact
Important
A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le | — |
Workaround
|
Threats
Impact
Important
References
23 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4 is now available.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.27.2, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-49978 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15013)\n* CVE-2026-49978 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15016)\n* CVE-2026-59877 openshift-service-mesh/kiali-ossmc-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15029)\n* CVE-2026-59877 openshift-service-mesh/kiali-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15030)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:49735",
"url": "https://access.redhat.com/errata/RHSA-2026:49735"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
"url": "https://access.redhat.com/security/cve/CVE-2026-49978"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
"url": "https://access.redhat.com/security/cve/CVE-2026-59877"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49735.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4",
"tracking": {
"current_release_date": "2026-08-05T18:46:42+00:00",
"generator": {
"date": "2026-08-05T18:46:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:49735",
"initial_release_date": "2026-08-03T17:11:17+00:00",
"revision_history": [
{
"date": "2026-08-03T17:11:17+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-03T17:11:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-05T18:46:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.4",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806708"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-operator-bundle@sha256%3Af7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-operator-bundle\u0026tag=1784923616"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1784795355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824894"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806708"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1784795355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824894"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806708"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3Ae1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1784795355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Afcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824894"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806708"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1784795355"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824894"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
"product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-49978",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-07-14T21:05:26.253019+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-49978"
},
{
"category": "external",
"summary": "RHBZ#2500695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
"url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
"url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
},
{
"category": "external",
"summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
}
],
"release_date": "2026-07-14T20:02:46.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T17:11:17+00:00",
"details": "See Kiali 2.27.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49735"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
},
{
"cve": "CVE-2026-59877",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-08T16:01:54.459482+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498127"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59877"
},
{
"category": "external",
"summary": "RHBZ#2498127",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
"url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
"url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
"url": "https://github.com/protobufjs/protobuf.js/pull/2352"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
}
],
"release_date": "2026-07-08T15:28:07.696000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-03T17:11:17+00:00",
"details": "See Kiali 2.27.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:49735"
},
{
"category": "workaround",
"details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64",
"Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…