RHSA-2026:33160HighCVSS 8.7

Red Hat Security Advisory: Kiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0

Published
June 29, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (11)

CVE-2026-39821 →CVE-2026-44487 →CVE-2026-44495 →CVE-2026-48779 →CVE-2026-12143 →CVE-2026-42338 →CVE-2026-44486 →CVE-2026-44488 →CVE-2026-44492 →CVE-2026-44494 →CVE-2026-44496 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:163c0867091d50fae1acfc08b5631ada2be4a49c056adbee9a60166b97a88d5d_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:527644abdbe3cabab1f48223a1c0ee8048d7ced2b331c6b50cb0f08decfd6b4c_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7072a730964e67001c15c156743e2726bb6dbaf7d8ee6338c337d94fafb079ed_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:ab8453c70ec43c8782332d31f81758a47d79703bbfc06965947ab7d72404c374_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:12ce2d6283ac3fe295e53ac099b14222722fdcb9c549fbe2243ae83069f3cfa4_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:1b110d69b83fa0ed08e2cf38a981ad4fcadc8d01b0f9e4b1c0f4f93eba00df55_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:c878bf475fb5ded36d666d59a5d1d7a15e4ec3ba0b54893cc09180e1af431db6_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:cf2dbdd1c93fe967961000699880b74f2234de06335682f264dac8fdd96fef09_arm64 as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Kiali 2.4.19 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0/html/observability/kiali-operator-provided-by-red-hat Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)