RHSA-2026:33155HighCVSS 8.7

Red Hat Security Advisory: Kiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6

Published
June 29, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (11)

CVE-2026-44488 →CVE-2026-44492 →CVE-2026-44494 →CVE-2026-44496 →CVE-2026-12143 →CVE-2026-39821 →CVE-2026-42338 →CVE-2026-44486 →CVE-2026-44495 →CVE-2026-48779 →CVE-2026-44487 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:431be7a67581ddb521dc3e8a2d7fb59fdc2bfe8362e364aed4cdc8bb441495c0_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:71bf14b0c1b05f821567971253f304ccc8a58cc682aa9dfe2805dc096f29ce39_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:75a4205abf3e9d948907598c52e18b89d5656e3bab72846319ca9d7162c9b123_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:f71032abc7a0d0885b56bf99a59c0b8800844297c0ff96fb2561edc493a0a0a2_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:70f6b5471f8994330a6659bc2b863bff2792552231237d217825d432c166dfd9_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:cf60d7a68c8b997e899f71a049e0d43d6d07115ed544a79db569bc8c33306e75_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ed47a2c0145d0e71f6c7dca89f1cb502098ab54c679367b2c7374fd6ca2da413_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:eff6e4643347f77c419cb3e32b4c9d914762b9f2114e832126964850b7179967_amd64 as a component of Red Hat OpenShift Service Mesh 2.6

✅ Remediation

See Kiali 1.73.33 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)