RHSA-2026:68695: Kiali 2.27.4 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.Security Fix(es): CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737) CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740) CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via INPLACE sanitization (OSSM-15747) CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via INPLACE sanitization (OSSM-15748) CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850) CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851) CVE-2026-92982 openshift-service-mesh/kiali-rhel9-operator: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection (OSSM-15862) CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) Bug Fix(es): OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.