RHSA-2026:33163HighCVSS 8.7

Red Hat Security Advisory: Kiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1

Published
June 29, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (11)

CVE-2026-39821 →CVE-2026-42338 →CVE-2026-44488 →CVE-2026-44492 →CVE-2026-44494 →CVE-2026-44495 →CVE-2026-44496 →CVE-2026-44486 →CVE-2026-44487 →CVE-2026-48779 →CVE-2026-12143 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1c422bbe4c19201f0a63dd8175ae962208cbffccf096912858e6274b214994af_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:853f2430db6aceeb634f4c2059947d22547e39978c1185dc48ba3be4f7d337b6_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:cd49f834dca7cc30e12add0fb3247d82981f722d353fc15523ad247df8e6d25c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:cf353c0b22a951c13996d5227406ed75923bf6dbaed9ea50892f32d664003c8d_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:99e5e5ef3be5b42ef54d1fbcceac268c670c05a47c3e982c1088d010499c9ae8_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:9ac5ee0b1ffc79c320478d77a24d62789eb7162a564dc0e2be3c0a2ae2ffb272_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:c5926bbd0cb2414e4fd0117e11ccec6d33924c2ea255ca7f500419c7886807cf_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:ca9d114cccf1e213f392c73a4f36af7efef15bc016636d27fc5c736a933cda14_arm64 as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Kiali 2.11.13 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1/html/observability/kiali-operator-provided-by-red-hat Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)