Kiali 2.27.4, for Red Hat OpenShift Service Mesh 3.4, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.Security Fix(es): CVE-2026-45820 openshift-service-mesh/kiali-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15737) CVE-2026-45820 openshift-service-mesh/kiali-ossmc-rhel9: fflate: Denial of Service via crafted ZIP archives (OSSM-15740) CVE-2026-75838 openshift-service-mesh/kiali-ossmc-rhel9: DOMPurify: Cross-Site Scripting via INPLACE sanitization (OSSM-15747) CVE-2026-75838 openshift-service-mesh/kiali-rhel9: DOMPurify: Cross-Site Scripting via INPLACE sanitization (OSSM-15748) CVE-2026-84375 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15850) CVE-2026-84375 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service vulnerability in YAML parsing (OSSM-15851) CVE-2026-92982 openshift-service-mesh/kiali-rhel9-operator: Ansible Operator Plugins: Arbitrary Code Execution via Jinja2 Template Injection (OSSM-15862) CVE-2026-56860 openshift-service-mesh/kiali-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15404) CVE-2026-56862 openshift-service-mesh/kiali-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15447) CVE-2026-33818 openshift-service-mesh/kiali-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15457) Bug Fix(es): OSSM-15616 Service Mesh console only shows one control plane revision in Namespaces view during RevisionBased upgrade For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): kiali-ossmc-container: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat OpenShift Service Mesh Containers for 2.4.14
Important: Red Hat OpenShift Service Mesh Containers for 2.5.8
Important: Red Hat OpenShift Service Mesh Containers for 2.6.5
The vulnerability arises due to insufficient sanitization of HTTP headers within the OpenShift Service Mesh, specifically allowing log injection attacks via the x-forwarded-for header. This could result in misleading log entries, potential XSS attacks, and misattribution of request sources. However, the impact is limited since it primarily affects logging and does not directly lead to remote code execution or privilege escalation.
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
Low: Red Hat OpenShift Service Mesh Containers for 2.4.13
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.7
Important: Red Hat OpenShift Service Mesh Containers for 2.5.6
Moderate: Red Hat OpenShift Service Mesh Containers for 2.6.3
Important: Red Hat OpenShift Service Mesh Containers for 2.6.2
Important: Red Hat OpenShift Service Mesh Containers for 2.5.5
Important: Red Hat OpenShift Service Mesh Containers for 2.4.11
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): quic-go: memory exhaustion attack against QUIC's connection ID mechanism(CVE-2024-22189) moby: cert signing bypass(CVE-2018-12608) golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789) jose: resource exhaustion(CVE-2024-28176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat OpenShift Service Mesh Containers for 2.4.8 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.2 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.1 security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset Attack) (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: Red Hat OpenShift Service Mesh for 2.4.4 security update
Important: Red Hat OpenShift Service Mesh for 2.3.8 security update
Important: Red Hat OpenShift Service Mesh for 2.2.11 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.3 security update
Important: Red Hat OpenShift Service Mesh 2.2.10 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update
Important: Red Hat OpenShift Service Mesh 2.2.9 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.3.6 security update
Moderate: Red Hat OpenShift Service Mesh 2.2.8 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.1 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.3.5 security update