RHSA-2026:8483CriticalCVSS 9.1

Red Hat Security Advisory: Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6

Published
April 16, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (10)

CVE-2025-62718 →CVE-2025-68121 →CVE-2026-4800 →CVE-2026-27606 →CVE-2026-29063 →CVE-2025-61726 →CVE-2026-25679 →CVE-2026-29074 →CVE-2026-33186 →CVE-2026-40175 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:2723d4214014bab37f24dd8311306f757bf12284085ed6c2bcd8176478a2e1b0_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:5a8f7d36fcf35bfc9260ac3e3629790d607405ecd692a9d87c29b1257cfb6d51_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:6c99c3ca8c99dfa4d49e6be2dd651345a4f6e2267fb2e06ab8acec04880d71c9_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8@sha256:e7a923633d55a9b67580732d7449e2631b07787ae22431888245dc234bca5871_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:56e3e74a021ca82802a7ec1e9b62ba3770e0c27a4039f9ea69a9b1ce89f2f3bb_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:7eb2835c07bac105bfa2661398245cbebbc7acf9924229b8dce38db7dd3fabbb_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:d4a4b0719e113cdbfd763946d8c9e1adf9d59352657680abec71a7094fc73a4d_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/kiali-rhel8@sha256:ecb548342d0ea45b30c965e86678068c5735bd603b7d6507308f5566f7b8c7cf_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6

✅ Remediation

See Kiali 1.73.29 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/service_mesh/service-mesh-2-x Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (14)