This advisory covers security fixes in Kiali 1.73.25 for Red Hat OpenShift Service Mesh 2.6. The fixes address two main vulnerabilities: CVE-2025-66031, an unbounded recursion vulnerability in the node-forge ASN.1 implementation that could lead to resource exhaustion or denial of service; and CVE-2025-64756, a command injection vulnerability in the glob CLI where the -c/--cmd option executes matches with shell:true, potentially allowing arbitrary command execution. The advisory references Red Hat's official errata RHSA-2025:22936 and includes updated container images for multiple architectures. No explicit CVSS scores are provided.

The vulnerabilities impact the Kiali component of Red Hat OpenShift Service Mesh 2.6, potentially allowing attackers to cause denial of service through unbounded recursion or execute arbitrary commands via command injection. This could compromise the observability and management capabilities of the service mesh, affecting monitoring and tracing functions.

The vendor has released Kiali version 1.73.25 containing fixes for these vulnerabilities. Users should upgrade to Kiali 1.73.25 as documented in the Red Hat advisory RHSA-2025:22936. Since this is not a cloud service, remediation requires applying the updated version. No additional mitigation steps are specified or required beyond upgrading.