The advisory covers two main vulnerabilities in Kiali 1.73.27 for Red Hat OpenShift Service Mesh 2.6. CVE-2025-61729 is a golang vulnerability where a specially crafted certificate triggers unbounded string concatenation during error string construction in HostnameError.Error(), leading to excessive resource consumption and potential denial of service. CVE-2026-25639 affects Axios used in Kiali, where a denial of service can be triggered via the __proto__ key in the mergeConfig function. Both vulnerabilities can cause denial of service conditions by exhausting CPU, memory, or other resources. Red Hat classifies the impact as important and assigns a high severity rating. The advisory does not explicitly state a fixed version but references Kiali 1.73.27 as the version containing the fixes.

Successful exploitation of CVE-2025-61729 can cause denial of service due to excessive resource consumption (CPU, memory, or other resources) triggered by a crafted certificate during error processing in golang. CVE-2026-25639 can cause denial of service via manipulation of the __proto__ key in Axios mergeConfig. Both vulnerabilities impact availability by potentially causing service disruption or degradation in Red Hat OpenShift Service Mesh 2.6 environments running Kiali 1.73.27 or earlier. There is no indication of confidentiality or integrity impact.

Red Hat has released Kiali version 1.73.27 for OpenShift Service Mesh 2.6 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. No additional mitigations or workarounds are specified in the advisory. Since this is not a cloud service, remediation is the responsibility of the user. Patch status is confirmed by the vendor advisory referencing Kiali 1.73.27 as the fixed version.