RHSA-2026:49735HighCVSS 8.1

Red Hat Security Advisory: Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4

Published
August 3, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (2)

CVE-2026-49978 →CVE-2026-59877 →

📋 Description

CVE-2026-49978 — dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema

🎯 Affected products14

  • Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:f7f25ebbf9155294e6bee40efe6561f977cf0d220a99f9293393de0d2958b681_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:2592b2265e741f6d0611d9cff263325096f7dc028497d35bf9a7e5e720a611a4_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:337ddd9fabcc157f8cbf18da97eeeca87596df3e689e74bc1c7a0efe15dee14d_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7ac83cc75b81f6a7433c5100a400dbaf99b08be360c3adc27a7254776be5e3fa_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:fcdb3de789dee7f7fc239ccfb7009e1e7b19ab8d856830fffe9024edf523ba30_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:6d03187833860bbd53d73e36ab4b55bcd88b1e65c1658b5e620af4d1cfa2683f_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:722316aef2be0035d376d8c11c1d7cd5fc0b06b1aa4283f6f5438ebe9c0be176_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:84c2cf4e72176f8a808b757ae1a6745fe3e6249eef45454be0c6796006dd35ef_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:e1fb9b65c79c379bdbe104e1889f7060b1a562052ae9186e3c31045b5dd26e72_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:109b450a9462930739211f5ab5a6d471d4b167c2a24918ba76ee3ddbe88ae17c_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4c15949d1bfe0310e4d658e24b601ab78f683dd040dda79ef2133589f35c0f68_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:59c3c3e0a0ab9b56bcdee7a0e4a4368054c8fce8b4ff4757f4071e465fb736c4_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:63f0bdca33d94240b622310617c3b640660c216c3e7ddf6a29cd5ffc64c9930d_arm64 as a component of Red Hat OpenShift Service Mesh 3.4

✅ Remediation

See Kiali 2.27.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4/html/observability/kiali-operator-provided-by-red-hat Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.

🔗 References (6)