RHSA-2026:3109
Vulnerability from csaf_redhat - Published: 2026-02-23 17:26 - Updated: 2026-03-12 12:42Summary
Red Hat Security Advisory: Kiali 2.17.4 for Red Hat OpenShift Service Mesh 3.2
Notes
Topic
Kiali 2.17.4 for Red Hat OpenShift Service Mesh 3.2
This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Kiali 2.17.4, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* kiali-ossmc-rhel9: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639)
* kiali-rhel9: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Kiali 2.17.4 for Red Hat OpenShift Service Mesh 3.2\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Kiali 2.17.4, for Red Hat OpenShift Service Mesh 3.2, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* kiali-ossmc-rhel9: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639)\n\n* kiali-rhel9: Axios affected by Denial of Service via __proto__ Key in mergeConfig (CVE-2026-25639) ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:3109",
"url": "https://access.redhat.com/errata/RHSA-2026:3109"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25639",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/cve-2026-25639",
"url": "https://access.redhat.com/security/cve/cve-2026-25639"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification",
"url": "https://access.redhat.com/security/updates/classification"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3109.json"
}
],
"title": "Red Hat Security Advisory: Kiali 2.17.4 for Red Hat OpenShift Service Mesh 3.2",
"tracking": {
"current_release_date": "2026-03-12T12:42:32+00:00",
"generator": {
"date": "2026-03-12T12:42:32+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.3"
}
},
"id": "RHSA-2026:3109",
"initial_release_date": "2026-02-23T17:26:20+00:00",
"revision_history": [
{
"date": "2026-02-23T17:26:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-02-23T17:26:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-03-12T12:42:32+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Service Mesh 3.2",
"product": {
"name": "Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:service_mesh:3.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Service Mesh"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771385315"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-operator-bundle@sha256%3A7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771390706"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3Ac772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771384898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771229583"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771385315"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771384898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771229583"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771385315"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3A44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771384898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771229583"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9@sha256%3A5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771385315"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-rhel9-operator@sha256%3Aeec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771384898"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"product": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"product_identification_helper": {
"purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh\u0026tag=1771229583"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64 as a component of Red Hat OpenShift Service Mesh 3.2",
"product_id": "Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64"
},
"product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64",
"relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25639",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-02-09T21:00:49.280114+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438237"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64"
],
"known_not_affected": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25639"
},
{
"category": "external",
"summary": "RHBZ#2438237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25639",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25639"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57",
"url": "https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases/tag/v1.13.5",
"url": "https://github.com/axios/axios/releases/tag/v1.13.5"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433",
"url": "https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433"
}
],
"release_date": "2026-02-09T20:11:22.374000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-02-23T17:26:20+00:00",
"details": "See Kiali 2.17.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2/html/observability/kiali-operator-provided-by-red-hat",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:3109"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x",
"Red Hat OpenShift Service Mesh 3.2:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…