RHSA-2026:33173HighCVSS 8.7

Red Hat Security Advisory: Kiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2

Published
June 29, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (12)

CVE-2026-44494 →CVE-2026-44492 →CVE-2026-44495 →CVE-2026-44496 →CVE-2026-48779 →CVE-2026-12143 →CVE-2026-39821 →CVE-2026-42264 →CVE-2026-42338 →CVE-2026-44486 →CVE-2026-44487 →CVE-2026-44488 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42264 — axios: Axios: Prototype pollution allows information disclosure and request manipulation CVE-2026-42338 — ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-48779 — ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:25cea20e2ae09312237993c254bebc58983e3907469758392d7e97e9859b59c8_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:26fc99e8a9aa85fee4c07b4d77b4c699a41af995888f017ca1ab650d9777f20a_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:cf7b68e5a7e3b4ecbab43eba4196a71b7f859fb6f9a4e11fe9dfd2ad530f684a_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:f08bc5caad4465d35f3526bdb1a43c4f56a2a70e6e0f584a291ca8984444bc5f_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:28ff05488ce8333b7b2cf2a68f465d0ba085064ba474ccee2652c7e8d4c8f5ab_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:2c2d500314bd8380c4dc06068ac379eadbc8c376bfa232cbf3c7bf1816a0d628_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6cc59e499071fb3a97ecfcdab32b29ed94b3e725d4c0c47f67b096205296e7e3_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:790215d0593d974c79ae90cd01d71b8a0f7d872c1b0ad78870d9f2ae28eaff5c_arm64 as a component of Red Hat OpenShift Service Mesh 3.2

✅ Remediation

See Kiali 2.17.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)