{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3 is now available.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Kiali 2.22.8, for Red Hat OpenShift Service Mesh 3.3, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.\n\nSecurity Fix(es):\n\n* CVE-2026-59873 openshift-service-mesh/kiali-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14905)\n* CVE-2026-59873 openshift-service-mesh/kiali-ossmc-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14908)\n* CVE-2026-59874 openshift-service-mesh/kiali-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14909)\n* CVE-2026-59874 openshift-service-mesh/kiali-ossmc-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14912)\n* CVE-2026-59869 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14928)\n* CVE-2026-59869 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14930)\n* CVE-2026-49978 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15014)\n* CVE-2026-49978 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-site scripting vulnerability allows code execution (OSSM-15015)\n* CVE-2026-59877 openshift-service-mesh/kiali-ossmc-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15027)\n* CVE-2026-59877 openshift-service-mesh/kiali-rhel9: protobufjs: Denial of Service via crafted .proto schema (OSSM-15028)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:49680",
        "url": "https://access.redhat.com/errata/RHSA-2026:49680"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59873",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59874",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49680.json"
      }
    ],
    "title": "Red Hat Security Advisory: Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3",
    "tracking": {
      "current_release_date": "2026-08-05T08:53:49+00:00",
      "generator": {
        "date": "2026-08-05T08:53:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:49680",
      "initial_release_date": "2026-08-03T13:31:22+00:00",
      "revision_history": [
        {
          "date": "2026-08-03T13:31:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-03T13:31:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T08:53:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.3",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.3",
                  "product_id": "Red Hat OpenShift Service Mesh 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806326"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824388"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806326"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824388"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3Aa9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806326"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824388"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-rhel9@sha256%3A91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel9\u0026tag=1784806326"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kiali-ossmc-rhel9@sha256%3A0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9\u0026tag=1784824388"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T13:31:22+00:00",
          "details": "See Kiali 2.22.8 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49680"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T13:31:22+00:00",
          "details": "See Kiali 2.22.8 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49680"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T13:31:22+00:00",
          "details": "See Kiali 2.22.8 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49680"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T13:31:22+00:00",
          "details": "See Kiali 2.22.8 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49680"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    },
    {
      "cve": "CVE-2026-59877",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-08T16:01:54.459482+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
          "url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
          "url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
          "url": "https://github.com/protobufjs/protobuf.js/pull/2352"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
        }
      ],
      "release_date": "2026-07-08T15:28:07.696000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-03T13:31:22+00:00",
          "details": "See Kiali 2.22.8 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3/html/observability/kiali-operator-provided-by-red-hat",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:49680"
        },
        {
          "category": "workaround",
          "details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
    }
  ]
}