CVE-2025-61729VulnerabilityPublished 23 Feb 2026Updated 30 Oct 2026

Red Hat Security Advisory: Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6

Affects Red HatSource GCVE Database

Compare

Mentioned vulnerabilities

CVE-2026-25639

Authoritative record:CVE-2025-61729· High 7.5

Not known to be exploited · CVSS 7.5 High · patch available : patch Red Hat x509 soon.

Data as of 30 Oct 2026, 06:59 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Gogithub.com/golang/go/src/crypto/x509`pkg:golang/github.com/golang/go/src/crypto/x509`Other threats	Affected =0 =1.25.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released Kiali version 1.73.27 for OpenShift Service Mesh 2.6 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. No additional mitigations or workarounds are specified in the advisory. Since this is not a cloud service, remediation is the responsibility of the user. Patch status is confirmed by the vendor advisory referencing Kiali 1.73.27 as the fixed version.

Description

Release of RHOAI 2.25.11 provides these changes:

Impact

Successful exploitation of CVE-2025-61729 can cause denial of service due to excessive resource consumption (CPU, memory, or other resources) triggered by a crafted certificate during error processing in golang. CVE-2026-25639 can cause denial of service via manipulation of the __proto__ key in Axios mergeConfig. Both vulnerabilities impact availability by potentially causing service disruption or degradation in Red Hat OpenShift Service Mesh 2.6 environments running Kiali 1.73.27 or earlier. There is no indication of confidentiality or integrity impact.

Summary

The advisory covers two main vulnerabilities in Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6. CVE-2025-61729 is a golang vulnerability where a specially crafted certificate triggers unbounded string concatenation during error string construction in HostnameError.Error(), leading to excessive resource consumption and potential denial of service. CVE-2026-25639 affects Axios used in Kiali, where a denial of service can be triggered via the __proto__ key in the mergeConfig function. Both vulnerabilities can cause denial of service conditions by exhausting CPU, memory, or other resources. Red Hat classifies the impact as important and assigns a high severity rating. The advisory does not explicitly state a fixed version but references Kiali 1.73.27 as the version containing the fixes.

CWE-1050Excessive Platform Resource Consumption within a Loop (opens in a new tab)
Base weakness
The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1287Improper Validation of Specified Type of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-409Improper Handling of Highly Compressed Data (Data Amplification) (opens in a new tab)
Base weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.2 (opens in a new tab)
V12.1.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.3 (opens in a new tab)
V11.1.6 (opens in a new tab)
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1341Multiple Releases of Same Resource or Handle (opens in a new tab)
Base weakness
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
Implementation
Change the code's logic so that the resource is only closed once. This might require simplifying or refactoring. This fix can be simple to do in small code blocks, but more difficult when multiple closes are buried within complex conditionals.
Implementation · Refactoring
It can be effective to implement a flag that is (1) set when the resource is opened, (2) cleared when it is closed, and (3) checked before closing. This approach can be useful when there are disparate cases in which closes must be performed.
Implementation · Refactoring
When closing a resource, set the resource's associated variable to NULL or equivalent value for the given language. Some APIs will ignore this null value without causing errors.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1286Improper Validation of Syntactic Correctness of Input (opens in a new tab)
Base weakness
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
SQL Injection (opens in a new tab)
NoSQL Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-764Multiple Locks of a Critical Resource (opens in a new tab)
Base weakness
The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Implementation
When locking and unlocking a resource, try to be sure that all control paths through the code in which the resource is locked one or more times correspond to exactly as many unlocks.
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)
Base weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
OWASP Cheat Sheets
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V9.2.1 (opens in a new tab)
V1.9.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-787Out-of-bounds Write (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5
The product writes data past the end, or before the beginning, of the intended buffer.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Operation · Build and Compilation · Environment Hardening
Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-281Improper Preservation of Permissions (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1284Improper Validation of Specified Quantity in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-772Missing Release of Resource after Effective Lifetime (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Implementation
It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free resources in a function. If you allocate resources that you intend to free upon completion of the function, you must be sure to free the resources at all exit points for that function including…
Operation · Architecture and Design · Resource Limitation
Use resource-limiting settings provided by the operating system or environment. For example, when managing system resources in POSIX, setrlimit() can be used to set limits for certain types of resources, and getrlimit() can determine how many resources are available.
Attack patterns
HTTP DoS (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-476NULL Pointer Dereference (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #13OWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product dereferences a pointer that it expects to be valid but is NULL.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Requirements
Select a programming language that is not susceptible to these issues.
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.7 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-256Plaintext Storage of a Password (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product stores a password in plaintext within resources such as memory or files.
Architecture and Design
Avoid storing passwords in easily accessible locations.
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
OWASP Cheat Sheets
Forgot Password (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V2.7.5 (opens in a new tab)
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-303Incorrect Implementation of Authentication Algorithm (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.8.5 (opens in a new tab)
V2.8.4 (opens in a new tab)
V9.2.3 (opens in a new tab)
Attack patterns
Reflection Attack in Authentication Protocol (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-22Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
Implementation · Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V12.3.1 (opens in a new tab)
Attack patterns
Path Traversal (opens in a new tab)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
Using Escaped Slashes in Alternate Encoding (opens in a new tab)
Using Slashes in Alternate Encoding (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-1333Name not in the CWE catalogue (opens in a new tab)
CWE-940Name not in the CWE catalogue (opens in a new tab)
CWE-346Name not in the CWE catalogue (opens in a new tab)
CWE-918Name not in the CWE catalogue (opens in a new tab)
CWE-306Name not in the CWE catalogue (opens in a new tab)
CWE-250Name not in the CWE catalogue (opens in a new tab)
CWE-338Name not in the CWE catalogue (opens in a new tab)
CWE-915Name not in the CWE catalogue (opens in a new tab)
CWE-639Name not in the CWE catalogue (opens in a new tab)
CWE-266Name not in the CWE catalogue (opens in a new tab)
CWE-79Name not in the CWE catalogue (opens in a new tab)
CWE-835Name not in the CWE catalogue (opens in a new tab)
CWE-444Name not in the CWE catalogue (opens in a new tab)
CWE-88Name not in the CWE catalogue (opens in a new tab)
CWE-212Name not in the CWE catalogue (opens in a new tab)
CWE-502Name not in the CWE catalogue (opens in a new tab)
CWE-93Name not in the CWE catalogue (opens in a new tab)
CWE-201Name not in the CWE catalogue (opens in a new tab)
CWE-805Name not in the CWE catalogue (opens in a new tab)
CWE-824Name not in the CWE catalogue (opens in a new tab)
CWE-617Name not in the CWE catalogue (opens in a new tab)
CWE-347Name not in the CWE catalogue (opens in a new tab)
CWE-807Name not in the CWE catalogue (opens in a new tab)
CWE-911Name not in the CWE catalogue (opens in a new tab)
CWE-776Name not in the CWE catalogue (opens in a new tab)
CWE-674Name not in the CWE catalogue (opens in a new tab)
CWE-214Name not in the CWE catalogue (opens in a new tab)
CWE-78Name not in the CWE catalogue (opens in a new tab)
CWE-1389Name not in the CWE catalogue (opens in a new tab)
CWE-125Name not in the CWE catalogue (opens in a new tab)
CWE-914Name not in the CWE catalogue (opens in a new tab)
CWE-414Name not in the CWE catalogue (opens in a new tab)

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 21:53 UTC

WeaknessesCWE-1050, CWE-1287, CWE-409 +49

Technical details

References

Community reviews

Related threats