RHSA-2026:68695

Vulnerability from csaf_redhat - Published: 2026-09-17 15:45 - Updated: 2026-11-14 02:33
Summary
Red Hat Security Advisory: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4
Severity
Important
Notes
Topic: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737) * CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740) * CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15747) * CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15748) * CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850) * CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851) * CVE-2026-92982 openshift-service-mesh/kiali-rhel9-operator: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection (OSSM-15862) * CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) * CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) * CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) Bug Fix(es): * OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64 —
Workaround
Threats
Impact Important
CVE-2026-45820

A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service (DoS) condition. This occurs because a malformed central directory entry in the ZIP archive causes out-of-bounds reads, which keeps a processing loop permanently active.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64 —
Workaround
Threats
Impact Important
CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2026-33818
Known not affected 9 products, the same list as for CVE-2026-33818
Threats
Impact Important
CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2026-33818
Known not affected 9 products, the same list as for CVE-2026-33818
Threats
Impact Important
CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation
Affected products
Fixed 8 products, the same list as for CVE-2026-45820
Known not affected 5 products, the same list as for CVE-2026-45820
Threats
Impact Moderate
CVE-2026-84375

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition
Affected products
Fixed 8 products, the same list as for CVE-2026-45820
Known not affected 5 products, the same list as for CVE-2026-45820
Threats
Impact Moderate
CVE-2026-92982

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

8.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le —
Workaround
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:68695 self
https://access.redhat.com/security/cve/CVE-2026-33818 external
https://access.redhat.com/security/cve/CVE-2026-45820 external
https://access.redhat.com/security/cve/CVE-2026-56860 external
https://access.redhat.com/security/cve/CVE-2026-56862 external
https://access.redhat.com/security/cve/CVE-2026-75838 external
https://access.redhat.com/security/cve/CVE-2026-84375 external
https://access.redhat.com/security/cve/CVE-2026-92982 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-33818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 external
https://www.cve.org/CVERecord?id=CVE-2026-33818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 external
https://go.dev/cl/814980 external
https://go.dev/issue/80405 external
https://groups.google.com/g/golang-announce/c/94p… external
https://pkg.go.dev/vuln/GO-2026-5972 external
https://access.redhat.com/security/cve/CVE-2026-45820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2506034 external
https://www.cve.org/CVERecord?id=CVE-2026-45820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45820 external
https://github.com/101arrowz/fflate/blob/f7873560… external
https://www.npmjs.com/package/fflate external
https://access.redhat.com/security/cve/CVE-2026-56860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 external
https://www.cve.org/CVERecord?id=CVE-2026-56860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 external
https://go.dev/cl/803681 external
https://go.dev/issue/80494 external
https://pkg.go.dev/vuln/GO-2026-6218 external
https://access.redhat.com/security/cve/CVE-2026-56862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 external
https://www.cve.org/CVERecord?id=CVE-2026-56862 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 external
https://go.dev/cl/804261 external
https://go.dev/issue/80528 external
https://pkg.go.dev/vuln/GO-2026-6090 external
https://access.redhat.com/security/cve/CVE-2026-75838 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517772 external
https://www.cve.org/CVERecord?id=CVE-2026-75838 external
https://nvd.nist.gov/vuln/detail/CVE-2026-75838 external
https://github.com/cure53/DOMPurify/security/advi… external
https://www.vulncheck.com/advisories/dompurify-be… external
https://access.redhat.com/security/cve/CVE-2026-84375 self
https://bugzilla.redhat.com/show_bug.cgi?id=2527118 external
https://www.cve.org/CVERecord?id=CVE-2026-84375 external
https://nvd.nist.gov/vuln/detail/CVE-2026-84375 external
https://github.com/nodeca/js-yaml/commit/3485bc06… external
https://github.com/nodeca/js-yaml/commit/6a8e05f9… external
https://github.com/nodeca/js-yaml/commit/d90b6612… external
https://github.com/nodeca/js-yaml/pull/797 external
https://github.com/nodeca/js-yaml/releases/tag/3.15.2 external
https://github.com/nodeca/js-yaml/releases/tag/4.3.2 external
https://github.com/nodeca/js-yaml/security/adviso… external
https://access.redhat.com/security/cve/CVE-2026-92982 self
https://bugzilla.redhat.com/show_bug.cgi?id=2522227 external
https://www.cve.org/CVERecord?id=CVE-2026-92982 external
https://nvd.nist.gov/vuln/detail/CVE-2026-92982 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4 is now available.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737)\n* CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740)\n* CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15747)\n* CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15748)\n* CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850)\n* CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851)\n* CVE-2026-92982 openshift-service-mesh/kiali-rhel9-operator: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection (OSSM-15862)\n* CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404)\n* CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447)\n* CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457)\n\nBug Fix(es):\n\n* OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68695",
        "url": "https://access.redhat.com/errata/RHSA-2026:68695"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45820",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45820"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75838",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84375",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-92982",
        "url": "https://access.redhat.com/security/cve/CVE-2026-92982"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68695.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4",
    "tracking": {
      "current_release_date": "2026-11-14T02:33:15+00:00",
      "generator": {
        "date": "2026-11-14T02:33:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:68695",
      "initial_release_date": "2026-09-17T15:45:18+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T15:45:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-16T06:41:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-14T02:33:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.4",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.4",
                  "product_id": "Red Hat OpenShift Service Mesh 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-operator-bundle@sha256%3A896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-operator-bundle\u0026tag=1789478366"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3Aadd67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ab0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Adbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Afc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ae92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ac5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-45820",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-07-22T08:00:59.463875+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service (DoS) condition. This occurs because a malformed central directory entry in the ZIP archive causes out-of-bounds reads, which keeps a processing loop permanently active.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fflate: fflate: Denial of Service via crafted ZIP archives",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE describes a denial-of-service flaw in the fflate JavaScript compression library. Parsing a maliciously crafted ZIP archive via unzipSync()/unzip() triggers an infinite loop in the ZIP64 central-directory parser (z64e): a central directory entry declaring the ZIP64 size sentinel (0xFFFFFFFF) but omitting the required ZIP64 extra field causes out-of-bounds reads that keep the loop condition permanently true, consuming CPU indefinitely. Only fflate\u0027s ZIP-extraction APIs are affected; its gzip/deflate/zip-creation paths are not.\n\nRed Hat products bundle fflate almost exclusively within web-frontend assets. Each affected component was assessed individually. Components that reach fflate only through compression-only consumers (posthog-js gzip telemetry, jsPDF zlib) never invoke the vulnerable unzipSync/z64e path and are marked not affected (vulnerable code not in the execute path). Components that bundle fflate in the vulnerable version range (through 0.8.2) where the ZIP-extraction path could not be positively excluded are marked affected. Where the vulnerable path is reachable only from client-side browser code processing same-origin assets, practical impact is limited to a self-inflicted denial of service within the user\u0027s own browser session rather than a service-level outage.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714",
          "url": "https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/fflate",
          "url": "https://www.npmjs.com/package/fflate"
        }
      ],
      "release_date": "2026-07-22T06:57:13.726000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate\u0027s unzip()/unzipSync() APIs.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fflate: fflate: Denial of Service via crafted ZIP archives"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-75838",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-08-18T11:32:11.523560+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517772"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting flaw in DOMPurify affects Red Hat products that utilize the library for HTML sanitization. The vulnerability allows attackers to execute arbitrary JavaScript by exploiting incomplete neutralization of detached subtrees during IN_PLACE sanitization, but only when a non-default configuration involving an element-removal hook is in use and user interaction with specially crafted content occurs.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517772",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517772"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75838",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook"
        }
      ],
      "release_date": "2026-08-18T11:19:47.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization"
    },
    {
      "cve": "CVE-2026-84375",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-09-01T21:51:30.205823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527118"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in js-yaml, affecting applications that process untrusted YAML input. The flaw allows an attacker to craft a small YAML document that, when parsed, can lead to prolonged CPU consumption due to inefficient merge key processing, potentially exhausting system resources. This is particularly relevant where applications handle external YAML data and have merge processing enabled by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527118",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527118"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
          "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
          "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
          "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/pull/797",
          "url": "https://github.com/nodeca/js-yaml/pull/797"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"
        }
      ],
      "release_date": "2026-09-01T21:43:13.617000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing"
    },
    {
      "cve": "CVE-2026-92982",
      "cwe": {
        "id": "CWE-1336",
        "name": "Improper Neutralization of Special Elements Used in a Template Engine"
      },
      "discovery_date": "2026-08-24T17:38:59+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2522227"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator\u0027s service account with cluster-wide permissions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having an Important impact rather than Critical because exploitation is bounded by the prerequisite of having authenticated access to create or modify custom resources. Upon reconciliation, malicious template syntax embedded in the resource specification executes within the operator environment, exposing the service account\u0027s cluster-level privileges. In default Red Hat deployments utilizing Ansible-based operators, watched resource attributes are automatically forwarded into the runner environment without unsafe designation. Operators constructed with Go or Helm frameworks do not utilize this templating workflow and are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-92982"
        },
        {
          "category": "external",
          "summary": "RHBZ#2522227",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522227"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-92982",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-92982"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-92982",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92982"
        }
      ],
      "release_date": "2026-10-15T13:33:42.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, configure the Ansible Operator watch to explicitly mark custom resource (CR) spec values as unsafe. This can be achieved by setting `markUnsafe: true` in the `watches.yaml` configuration for the affected operator. This action prevents Jinja2 template injection by ensuring CR spec fields are not evaluated as templates. A restart of the operator pod may be required for the changes to take effect.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ansible-operator-plugins: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.