This advisory covers two vulnerabilities affecting Kiali 1.73.31 in Red Hat OpenShift Service Mesh 2.6. The first, CVE-2026-32281, is a denial of service vulnerability in Go's crypto/x509 package caused by inefficient processing of certificate chains with many policy mappings, leading to excessive resource consumption during validation. Exploitation requires presenting a specially crafted, yet trusted, certificate chain, which implies the attacker must have compromised a trusted root certificate. The second, CVE-2026-42044, involves prototype pollution in Axios enabling invisible JSON response tampering. Red Hat has not provided a patch or effective mitigation for CVE-2026-32281 that meets their criteria. The advisory includes detailed references and notes that Red Hat continuously monitors trusted certificate authorities to reduce risk.

The primary impact is a denial of service condition due to excessive resource consumption during certificate chain validation (CVE-2026-32281). This can degrade performance or cause service unavailability in affected applications. Exploitation requires a trusted but specially crafted certificate chain, implying a prerequisite compromise of a trusted root certificate. The second vulnerability (CVE-2026-42044) allows tampering with JSON responses via prototype pollution, potentially affecting data integrity. Both vulnerabilities are rated with high severity by Red Hat.

Currently, no mitigation or patch meets Red Hat's criteria for ease of use, applicability, or stability for CVE-2026-32281. Red Hat recommends monitoring their advisories for updates. For CVE-2026-32281, risk is partially mitigated by Red Hat's continuous monitoring and curation of trusted certificate authorities. Users should follow Red Hat's guidance and consider upgrading to fixed versions when available. No specific mitigation details are provided for CVE-2026-42044 in the advisory. Customers with Red Hat Technical Account Managers can seek direct support for this issue.