RHSA-2026:59566HighCVSS 8.6

Red Hat Security Advisory: Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3

Published
August 25, 2026
Last Modified
September 14, 2026

🔗 CVE IDs covered (20)

CVE-2026-33818 →CVE-2026-56852 →CVE-2026-56858 →CVE-2026-73089 →CVE-2026-14257 →CVE-2026-45623 →CVE-2026-54272 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-67314 →CVE-2026-67320 →CVE-2026-45149 →CVE-2026-56862 →CVE-2026-67313 →CVE-2026-67321 →CVE-2026-69152 →CVE-2026-69153 →CVE-2026-69192 →CVE-2026-73088 →

📋 Description

CVE-2026-14257 — brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-45149 — brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges CVE-2026-45623 — postcss: PostCSS: Information disclosure and denial of service via crafted CSS input CVE-2026-54272 — ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-67313 — axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON CVE-2026-67314 — axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth CVE-2026-67320 — axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter CVE-2026-67321 — axios: axios: Denial of Service via object serialization bypass CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-69153 — postcss: PostCSS: Information disclosure via crafted sourceMappingURL CVE-2026-69192 — ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass CVE-2026-73088 — browserslist: Browserslist: Prototype pollution leading to denial of service CVE-2026-73089 — browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64 as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat Workaround: Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion. Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output. As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function. Workaround: Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely. Workaround: To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.

🔗 References (24)