RHSA-2026:8483

Vulnerability from csaf_redhat - Published: 2026-04-16 13:44 - Updated: 2026-04-16 20:43
Summary
Red Hat Security Advisory: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
Severity
Critical
Notes
Topic: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6 is now available. An update is now available for Red Hat OpenShift Service Mesh 2.6. This advisory contains the RPM packages for the Kiali component. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Kiali 1.73.29, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently. Security Fix(es): * CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url (OSSM-12470) * CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13225, OSSM-13226) * CVE-2025-68121 Unexpected session resumption in crypto/tls (OSSM-12553) * CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12952) * CVE-2026-27606 Rollup: Remote Code Execution via Path Traversal Vulnerability (OSSM-12689) * CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12891) * CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12970, OSSM-12971) * CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-12996) * CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13112, OSSM-13113) * CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13249, OSSM-13250) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-61726

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVE-2025-62718

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.

7.0 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CWE-1289 - Improper Validation of Unsafe Equivalence in Input
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2025-68121

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-27606

A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
CVE-2026-29063

A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
CVE-2026-29074

A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
Workaround To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.
CVE-2026-40175

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific "Gadget" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.

9.0 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vendor Fix See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x https://access.redhat.com/errata/RHSA-2026:8483
References
https://access.redhat.com/errata/RHSA-2026:8483 self
https://access.redhat.com/security/cve/CVE-2025-61726 external
https://access.redhat.com/security/cve/CVE-2025-62718 external
https://access.redhat.com/security/cve/CVE-2025-68121 external
https://access.redhat.com/security/cve/CVE-2026-25679 external
https://access.redhat.com/security/cve/CVE-2026-27606 external
https://access.redhat.com/security/cve/CVE-2026-29063 external
https://access.redhat.com/security/cve/CVE-2026-29074 external
https://access.redhat.com/security/cve/CVE-2026-33186 external
https://access.redhat.com/security/cve/CVE-2026-40175 external
https://access.redhat.com/security/cve/CVE-2026-4800 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-61726 self
https://bugzilla.redhat.com/show_bug.cgi?id=2434432 external
https://www.cve.org/CVERecord?id=CVE-2025-61726 external
https://nvd.nist.gov/vuln/detail/CVE-2025-61726 external
https://go.dev/cl/736712 external
https://go.dev/issue/77101 external
https://groups.google.com/g/golang-announce/c/Vd2… external
https://pkg.go.dev/vuln/GO-2026-4341 external
https://access.redhat.com/security/cve/CVE-2025-62718 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456913 external
https://www.cve.org/CVERecord?id=CVE-2025-62718 external
https://nvd.nist.gov/vuln/detail/CVE-2025-62718 external
https://datatracker.ietf.org/doc/html/rfc1034#sec… external
https://datatracker.ietf.org/doc/html/rfc3986#sec… external
https://github.com/axios/axios/commit/fb3befb6daa… external
https://github.com/axios/axios/pull/10661 external
https://github.com/axios/axios/releases/tag/v1.15.0 external
https://github.com/axios/axios/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2025-68121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2437111 external
https://www.cve.org/CVERecord?id=CVE-2025-68121 external
https://nvd.nist.gov/vuln/detail/CVE-2025-68121 external
https://go.dev/cl/737700 external
https://go.dev/issue/77217 external
https://groups.google.com/g/golang-announce/c/K09… external
https://pkg.go.dev/vuln/GO-2026-4337 external
https://access.redhat.com/security/cve/CVE-2026-4800 self
https://bugzilla.redhat.com/show_bug.cgi?id=2453496 external
https://www.cve.org/CVERecord?id=CVE-2026-4800 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4800 external
https://cna.openjsf.org/security-advisories.html external
https://github.com/advisories/GHSA-35jh-r3h4-6jhm external
https://github.com/lodash/lodash/commit/3469357cf… external
https://access.redhat.com/security/cve/CVE-2026-25679 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 external
https://www.cve.org/CVERecord?id=CVE-2026-25679 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 external
https://go.dev/cl/752180 external
https://go.dev/issue/77578 external
https://groups.google.com/g/golang-announce/c/Edh… external
https://pkg.go.dev/vuln/GO-2026-4601 external
https://access.redhat.com/security/cve/CVE-2026-27606 self
https://bugzilla.redhat.com/show_bug.cgi?id=2442530 external
https://www.cve.org/CVERecord?id=CVE-2026-27606 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27606 external
https://github.com/rollup/rollup/commit/c60770d7a… external
https://github.com/rollup/rollup/commit/c8cf1f9c4… external
https://github.com/rollup/rollup/commit/d6dee5e99… external
https://github.com/rollup/rollup/releases/tag/v2.80.0 external
https://github.com/rollup/rollup/releases/tag/v3.30.0 external
https://github.com/rollup/rollup/releases/tag/v4.59.0 external
https://github.com/rollup/rollup/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-29063 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445291 external
https://www.cve.org/CVERecord?id=CVE-2026-29063 external
https://nvd.nist.gov/vuln/detail/CVE-2026-29063 external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/rele… external
https://github.com/immutable-js/immutable-js/secu… external
https://access.redhat.com/security/cve/CVE-2026-29074 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445132 external
https://www.cve.org/CVERecord?id=CVE-2026-29074 external
https://nvd.nist.gov/vuln/detail/CVE-2026-29074 external
https://github.com/svg/svgo/security/advisories/G… external
https://access.redhat.com/security/cve/CVE-2026-33186 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 external
https://www.cve.org/CVERecord?id=CVE-2026-33186 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-40175 self
https://bugzilla.redhat.com/show_bug.cgi?id=2457432 external
https://www.cve.org/CVERecord?id=CVE-2026-40175 external
https://nvd.nist.gov/vuln/detail/CVE-2026-40175 external
https://github.com/axios/axios/commit/363185461b9… external
https://github.com/axios/axios/pull/10660 external
https://github.com/axios/axios/security/advisorie… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6 is now available.\nAn update is now available for Red Hat OpenShift Service Mesh 2.6. This advisory contains the RPM packages for the Kiali component.\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 1.73.29, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url (OSSM-12470)\n* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13225, OSSM-13226)\n* CVE-2025-68121 Unexpected session resumption in crypto/tls (OSSM-12553)\n* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12952)\n* CVE-2026-27606 Rollup: Remote Code Execution via Path Traversal Vulnerability (OSSM-12689)\n* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12891)\n* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027) (OSSM-12970, OSSM-12971)\n* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-12996)\n* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13112, OSSM-13113)\n* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13249, OSSM-13250)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:8483",
        "url": "https://access.redhat.com/errata/RHSA-2026:8483"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
        "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-62718",
        "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27606",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27606"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
        "url": "https://access.redhat.com/security/cve/CVE-2026-29063"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
        "url": "https://access.redhat.com/security/cve/CVE-2026-29074"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40175",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40175"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4800"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8483.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6",
    "tracking": {
      "current_release_date": "2026-04-16T20:43:54+00:00",
      "generator": {
        "date": "2026-04-16T20:43:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:8483",
      "initial_release_date": "2026-04-16T13:44:17+00:00",
      "revision_history": [
        {
          "date": "2026-04-16T13:44:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-16T13:44:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-16T20:43:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 2.6",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 2.6",
                  "product_id": "Red Hat OpenShift Service Mesh 2.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:2.6::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3Ad4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3Aecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3Ae7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel8@sha256%3A56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776191302"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel8@sha256%3A2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1776202125"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6",
          "product_id": "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 2.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-61726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-28T20:01:42.791305+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2434432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2434432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/736712",
          "url": "https://go.dev/cl/736712"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77101",
          "url": "https://go.dev/issue/77101"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4341",
          "url": "https://pkg.go.dev/vuln/GO-2026-4341"
        }
      ],
      "release_date": "2026-01-28T19:30:31.215000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "cve": "CVE-2025-62718",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-09T15:01:48.111177+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456913"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NO_PROXY rules. An attacker can exploit this by crafting requests to loopback addresses (e.g., localhost. or [::1]) which bypass the NO_PROXY configuration and are routed through the configured proxy. This can lead to Server-Side Request Forgery (SSRF) vulnerabilities, enabling attackers to access sensitive internal or loopback services that should otherwise be protected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has limited impact due to combination of non-default conditions to exploit: the attacker must be able to control or influence URLs passed to axios in a server-side context, the application must have both `HTTP_PROXY` and `NO_PROXY` configured, and the proxy itself must be positioned to act on the misdirected traffic or have been compromised by the attacker to intercept the rerouted traffic.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456913",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456913"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-62718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62718"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1",
          "url": "https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"
        },
        {
          "category": "external",
          "summary": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2",
          "url": "https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df",
          "url": "https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/10661",
          "url": "https://github.com/axios/axios/pull/10661"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"
        }
      ],
      "release_date": "2026-04-09T14:31:46.067000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization"
    },
    {
      "cve": "CVE-2025-68121",
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "cve": "CVE-2026-4800",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-03-31T20:01:21.918257+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453496"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453496",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
          "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
        },
        {
          "category": "external",
          "summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
          "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
        }
      ],
      "release_date": "2026-03-31T19:25:55.987000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-27606",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-02-25T04:01:24.449922+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2442530"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface (CLI) inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences (`../`), an attacker can overwrite files anywhere on the host filesystem where the build process has write permissions. This vulnerability can lead to persistent remote code execution (RCE) by overwriting critical system or user configuration files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27606"
        },
        {
          "category": "external",
          "summary": "RHBZ#2442530",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442530"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27606",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27606"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27606"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2",
          "url": "https://github.com/rollup/rollup/commit/c60770d7aaf750e512c1b2774989ea4596e660b2"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e",
          "url": "https://github.com/rollup/rollup/commit/c8cf1f9c48c516285758c1e11f08a54f304fd44e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3",
          "url": "https://github.com/rollup/rollup/commit/d6dee5e99bb82aac0bee1df4ab9efbde455452c3"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/releases/tag/v2.80.0",
          "url": "https://github.com/rollup/rollup/releases/tag/v2.80.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/releases/tag/v3.30.0",
          "url": "https://github.com/rollup/rollup/releases/tag/v3.30.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/releases/tag/v4.59.0",
          "url": "https://github.com/rollup/rollup/releases/tag/v4.59.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc",
          "url": "https://github.com/rollup/rollup/security/advisories/GHSA-mw96-cpmx-2vgc"
        }
      ],
      "release_date": "2026-02-25T02:08:06.682000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability"
    },
    {
      "cve": "CVE-2026-29063",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-03-06T19:00:57.982727+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445291"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29063"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445291",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
          "url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
          "url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
        }
      ],
      "release_date": "2026-03-06T18:25:22.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
    },
    {
      "cve": "CVE-2026-29074",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-03-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445132"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "svgo: SVGO: Denial of Service via XML entity expansion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29074"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445132",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
        },
        {
          "category": "external",
          "summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
          "url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
        }
      ],
      "release_date": "2026-03-06T07:23:05.716000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "svgo: SVGO: Denial of Service via XML entity expansion"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-40175",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-04-10T20:02:10.296601+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as Prototype Pollution, can be exploited through a specific \"Gadget\" attack chain. This allows an attacker to escalate a Prototype Pollution vulnerability in a third-party dependency, potentially leading to remote code execution or a full cloud compromise, such as bypassing AWS IMDSv2.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Critical impact: The Axios library, a promise-based HTTP client, is susceptible to a prototype pollution vulnerability. This flaw, when combined with specific \"Gadget\" attack chains in third-party dependencies, can lead to remote code execution or full cloud compromise, including bypassing AWS IMDSv2.\n \nWith pollution check patch available in Axios gives an advantage, it remains vulnerable due to HTTP Header Sanitation and Server-Side Request Forgery threat.\n\nRed Hat products that incorporate the vulnerable Axios library are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
          "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40175",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40175"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1",
          "url": "https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/10660",
          "url": "https://github.com/axios/axios/pull/10660"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.15.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"
        }
      ],
      "release_date": "2026-04-10T19:23:52.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-16T13:44:17+00:00",
          "details": "See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:8483"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64",
            "Red Hat OpenShift Service Mesh 2.6:registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "axios: Axios: Remote Code Execution via Prototype Pollution escalation"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.