Vulnerability-Lookup

RHSA-2026:68695

Vulnerability from csaf_redhat - Published: 2026-09-17 15:45 - Updated: 2026-09-23 12:13

Summary

Red Hat Security Advisory: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4

Severity

Important

Notes

Topic: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737) * CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740) * CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15747) * CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15748) * CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850) * CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851) * CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) * CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) * CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) Bug Fix(es): * OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le	—	Vendor Fix fix

Known not affected 9 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le		—
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64		—

Threats

Impact Important

CVE-2026-45820

A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service (DoS) condition. This occurs because a malformed central directory entry in the ZIP archive causes out-of-bounds reads, which keeps a processing loop permanently active.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le	—	Vendor Fix fix Workaround

Known not affected 5 products

Product	Version	Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64	—	Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x	—	Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64	—	Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le	—	Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64	—	Workaround

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 9 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 9 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 8 products, the same list as for CVE-2026-45820

Known not affected 5 products, the same list as for CVE-2026-45820

Threats

Impact Moderate

CVE-2026-84375

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 8 products, the same list as for CVE-2026-45820

Known not affected 5 products, the same list as for CVE-2026-45820

Threats

Impact Moderate

References

55 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68695	self
https://access.redhat.com/security/cve/CVE-2026-33818	external
https://access.redhat.com/security/cve/CVE-2026-45820	external
https://access.redhat.com/security/cve/CVE-2026-56860	external
https://access.redhat.com/security/cve/CVE-2026-56862	external
https://access.redhat.com/security/cve/CVE-2026-75838	external
https://access.redhat.com/security/cve/CVE-2026-84375	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-45820	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506034	external
https://www.cve.org/CVERecord?id=CVE-2026-45820	external
https://nvd.nist.gov/vuln/detail/CVE-2026-45820	external
https://github.com/101arrowz/fflate/blob/f7873560…	external
https://www.npmjs.com/package/fflate	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-75838	self
https://bugzilla.redhat.com/show_bug.cgi?id=2517772	external
https://www.cve.org/CVERecord?id=CVE-2026-75838	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75838	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-84375	self
https://bugzilla.redhat.com/show_bug.cgi?id=2527118	external
https://www.cve.org/CVERecord?id=CVE-2026-84375	external
https://nvd.nist.gov/vuln/detail/CVE-2026-84375	external
https://github.com/nodeca/js-yaml/commit/3485bc06…	external
https://github.com/nodeca/js-yaml/commit/6a8e05f9…	external
https://github.com/nodeca/js-yaml/commit/d90b6612…	external
https://github.com/nodeca/js-yaml/pull/797	external
https://github.com/nodeca/js-yaml/releases/tag/3.15.2	external
https://github.com/nodeca/js-yaml/releases/tag/4.3.2	external
https://github.com/nodeca/js-yaml/security/adviso…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4 is now available.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737)\n* CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740)\n* CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15747)\n* CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization (OSSM-15748)\n* CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850)\n* CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851)\n* CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404)\n* CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447)\n* CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457)\n\nBug Fix(es):\n\n* OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68695",
        "url": "https://access.redhat.com/errata/RHSA-2026:68695"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45820",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45820"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75838",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-84375",
        "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68695.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4",
    "tracking": {
      "current_release_date": "2026-09-23T12:13:20+00:00",
      "generator": {
        "date": "2026-09-23T12:13:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68695",
      "initial_release_date": "2026-09-17T15:45:18+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T15:45:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T15:45:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-23T12:13:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.4",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.4",
                  "product_id": "Red Hat OpenShift Service Mesh 3.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-operator-bundle@sha256%3A896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-operator-bundle\u0026tag=1789478366"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3Aadd67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ab0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Adbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Afc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ae92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1789021319"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9-operator@sha256%3A001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator\u0026tag=1789021200"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Ac5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1789475294"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64 as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4",
          "product_id": "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-45820",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-22T08:00:59.463875+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506034"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fflate. A remote attacker could exploit this vulnerability by providing a specially crafted ZIP archive. This archive, when processed, can lead to an infinite loop during decompression, causing a Denial of Service (DoS) condition. This occurs because a malformed central directory entry in the ZIP archive causes out-of-bounds reads, which keeps a processing loop permanently active.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fflate: fflate: Denial of Service via crafted ZIP archives",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE describes a denial-of-service flaw in the fflate JavaScript compression library. Parsing a maliciously crafted ZIP archive via unzipSync()/unzip() triggers an infinite loop in the ZIP64 central-directory parser (z64e): a central directory entry declaring the ZIP64 size sentinel (0xFFFFFFFF) but omitting the required ZIP64 extra field causes out-of-bounds reads that keep the loop condition permanently true, consuming CPU indefinitely. Only fflate\u0027s ZIP-extraction APIs are affected; its gzip/deflate/zip-creation paths are not.\n\nRed Hat products bundle fflate almost exclusively within web-frontend assets. Each affected component was assessed individually. Components that reach fflate only through compression-only consumers (posthog-js gzip telemetry, jsPDF zlib) never invoke the vulnerable unzipSync/z64e path and are marked not affected (vulnerable code not in the execute path). Components that bundle fflate in the vulnerable version range (through 0.8.2) where the ZIP-extraction path could not be positively excluded are marked affected. Where the vulnerable path is reachable only from client-side browser code processing same-origin assets, practical impact is limited to a self-inflicted denial of service within the user\u0027s own browser session rather than a service-level outage.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506034",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506034"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45820"
        },
        {
          "category": "external",
          "summary": "https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714",
          "url": "https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/fflate",
          "url": "https://www.npmjs.com/package/fflate"
        }
      ],
      "release_date": "2026-07-22T06:57:13.726000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "There is no available mitigation for this flaw other than updating the bundled fflate library to a fixed version (0.8.3 or later). Where the application controls the input, avoid passing untrusted ZIP archives to fflate\u0027s unzip()/unzipSync() APIs.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fflate: fflate: Denial of Service via crafted ZIP archives"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-75838",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-18T11:32:11.523560+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517772"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during IN_PLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of malicious scripts even after the HTML appears to be sanitized, leading to potential information disclosure or unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting flaw in DOMPurify affects Red Hat products that utilize the library for HTML sanitization. The vulnerability allows attackers to execute arbitrary JavaScript by exploiting incomplete neutralization of detached subtrees during IN_PLACE sanitization, but only when a non-default configuration involving an element-removal hook is in use and user interaction with specially crafted content occurs.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517772",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517772"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75838",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75838"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook"
        }
      ],
      "release_date": "2026-08-18T11:19:47.885000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization"
    },
    {
      "cve": "CVE-2026-84375",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-09-01T21:51:30.205823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2527118"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a denial of service (DoS) for applications that process untrusted YAML input.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in js-yaml, affecting applications that process untrusted YAML input. The flaw allows an attacker to craft a small YAML document that, when parsed, can lead to prolonged CPU consumption due to inefficient merge key processing, potentially exhausting system resources. This is particularly relevant where applications handle external YAML data and have merge processing enabled by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
          "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2527118",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527118"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-84375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84375"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
          "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
          "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
          "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/pull/797",
          "url": "https://github.com/nodeca/js-yaml/pull/797"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"
        }
      ],
      "release_date": "2026-09-01T21:43:13.617000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T15:45:18+00:00",
          "details": "See Kiali 2.27.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:896af31083024229cf6a374a8b7fb586a9fcba79ee1fec2994bf0ebe4f368714_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b0f9a4cdc3003f1d82faf4130875ab160d7aa6e7a06ff0c9fa2957f2baead00e_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:c5f3b706c375afc44acf3132e8ceced3cc132ba2e6c9ca71f2992d0683c395b8_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:dbde9c2f66225ee98652e145d574136b0f61629ed347d1ea638e897852182ef8_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:e92496baa0f7007348e0308fdc47183a8058b84f8ed7b66c636fa96892ebf428_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:001644cace33a253da0e1675f0f047b8852c355c32554a35b1b551cbe5d5e17c_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:881d2b4b54b3a79b3e4aa98f7150e6612508fd5b51937f04ed25f6a27dc88e2b_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:92125431177aa557141e761939ad12955455dadf28988d21002c7e29e68892c6_ppc64le",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:add67996fb8f7a14ae9834d136061e03b343f5d4e3595e95860920f6af95b696_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:00a87e941c275ac2a82f410054c5730f24752969511b5c638d17d70a5703c7e7_s390x",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:53c7b293f6fec0462394128ca3a22b1e3124eb018bc419ee15f75686be891b6d_arm64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:8939fd2ca94680072b54512c807eb20783e815149be99c00dad2ac4c4c125c28_amd64",
            "Red Hat OpenShift Service Mesh 3.4:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:fc6d16528f4e7486eba432ad3614f976cecdf7a2e9bff4b06c1da6d317de991a_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing"
    }
  ]
}

CVE-2026-33818 (GCVE-0-2026-33818)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-09-17 17:35

Title

Enforce maximum recursion depth in encoding/asn1

Summary

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:11 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80405
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814980
https://pkg.go.dev/vuln/GO-2026-5972

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/asn1	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Marwan Atia (marwansamir688@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:11:19.904646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:12:34.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/asn1",
          "product": "encoding/asn1",
          "programRoutines": [
            {
              "name": "parseSequenceOf"
            },
            {
              "name": "parseField"
            },
            {
              "name": "UnmarshalWithParams"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marwan Atia (marwansamir688@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T17:35:10.847Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80405"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814980"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "title": "Enforce maximum recursion depth in encoding/asn1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-33818",
    "datePublished": "2026-08-13T21:58:52.821Z",
    "dateReserved": "2026-03-23T20:35:32.815Z",
    "dateUpdated": "2026-09-17T17:35:10.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45820 (GCVE-0-2026-45820)

Vulnerability from cvelistv5 – Published: 2026-07-22 06:57 – Updated: 2026-07-22 12:53

Summary

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.

Severity

6.6 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-22 12:53 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400 - Uncontrolled Resource Consumption

Assigner

seal mitre root

References

2 references

URL	Tags
https://github.com/101arrowz/fflate/blob/f7873560…
https://www.npmjs.com/package/fflate

Impacted products

1 product

Vendor	Product	Version
101arrowz	fflate	Affected: 0.4.5 , ≤ 0.4.8 (semver) Affected: 0.5.0 , ≤ 0.5.3 (semver) Affected: 0.6.0 , ≤ 0.6.10 (semver) Affected: 0.7.0 , ≤ 0.7.4 (semver) Affected: 0.8.0 , ≤ 0.8.2 (semver)

Credits

Seal Security

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T12:53:26.309456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T12:53:38.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux",
            "macOS",
            "Windows"
          ],
          "product": "fflate",
          "vendor": "101arrowz",
          "versions": [
            {
              "lessThanOrEqual": "0.4.8",
              "status": "affected",
              "version": "0.4.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "0.5.3",
              "status": "affected",
              "version": "0.5.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "0.6.10",
              "status": "affected",
              "version": "0.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "0.7.4",
              "status": "affected",
              "version": "0.7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "0.8.2",
              "status": "affected",
              "version": "0.8.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Seal Security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true."
            }
          ],
          "value": "fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "NONE",
            "providerUrgency": "AMBER",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "MODERATE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-22T06:57:13.726Z",
        "orgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "shortName": "seal"
      },
      "references": [
        {
          "url": "https://github.com/101arrowz/fflate/blob/f7873560ad229c22c4b23b06c6a3806ffde77569/src/index.ts#L2714"
        },
        {
          "url": "https://www.npmjs.com/package/fflate"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
    "assignerShortName": "seal",
    "cveId": "CVE-2026-45820",
    "datePublished": "2026-07-22T06:57:13.726Z",
    "dateReserved": "2026-05-13T12:03:13.544Z",
    "dateUpdated": "2026-07-22T12:53:38.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56862 (GCVE-0-2026-56862)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29

Title

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Summary

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80528
https://go.dev/cl/804261
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6090

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Qi Deng of Aurascape.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:27:34.651997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:29:41.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.readRecordOrCCS"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qi Deng of Aurascape.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.216Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80528"
        },
        {
          "url": "https://go.dev/cl/804261"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56862",
    "datePublished": "2026-08-13T21:58:53.216Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:29:41.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75838 (GCVE-0-2026-75838)

Vulnerability from cvelistv5 – Published: 2026-08-18 11:19 – Updated: 2026-08-18 13:38

Title

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

Summary

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 13:36 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/cure53/DOMPurify/security/advi…	vendor-advisory
https://www.vulncheck.com/advisories/dompurify-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
cure53	DOMPurify	Affected: 0 , < 3.4.13 (semver) Unaffected: 3.4.13 (semver) cpe:2.3:a:cure53:dompurify::::::::

Date Public

2026-08-03 00:00

Credits

koyokr

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75838",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T13:36:33.246643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T13:38:34.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/dompurify",
          "product": "DOMPurify",
          "vendor": "cure53",
          "versions": [
            {
              "lessThan": "3.4.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.13",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "koyokr"
        }
      ],
      "datePublic": "2026-08-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T11:19:47.885Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-55q2-fjhq-7xh7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7"
        },
        {
          "name": "VulnCheck Advisory: DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook"
        }
      ],
      "title": "DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-75838",
    "datePublished": "2026-08-18T11:19:47.885Z",
    "dateReserved": "2026-08-18T10:59:33.701Z",
    "dateUpdated": "2026-08-18T13:38:34.515Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-84375 (GCVE-0-2026-84375)

Vulnerability from cvelistv5 – Published: 2026-09-01 21:43 – Updated: 2026-09-02 16:02

Title

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

Summary

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 13:43 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/nodeca/js-yaml/security/adviso…	x_refsource_CONFIRM
https://github.com/nodeca/js-yaml/pull/797	x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/3485bc06…	x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/6a8e05f9…	x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/d90b6612…	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/3.15.2	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/4.3.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nodeca	js-yaml	Affected: >= 3.0.0, < 3.15.2 Affected: >= 4.0.0, < 4.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84375",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T13:43:50.850378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T16:02:06.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "js-yaml",
          "vendor": "nodeca",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.15.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key \u003c\u003c. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. This issue is fixed in versions 3.15.2 and 4.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T21:43:13.617Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/pull/797",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/pull/797"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.2"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2883-xcg3-v3hh",
        "discovery": "UNKNOWN"
      },
      "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84375",
    "datePublished": "2026-09-01T21:43:13.617Z",
    "dateReserved": "2026-09-01T16:27:58.129Z",
    "dateUpdated": "2026-09-02T16:02:06.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68695

CVE-2026-33818 (GCVE-0-2026-33818)

CVE-2026-45820 (GCVE-0-2026-45820)

CVE-2026-56860 (GCVE-0-2026-56860)

CVE-2026-56862 (GCVE-0-2026-56862)

CVE-2026-75838 (GCVE-0-2026-75838)

CVE-2026-84375 (GCVE-0-2026-84375)

Tags

Sightings

Nomenclature

Related by attack behaviour