Kiali 2.17.12 for Red Hat OpenShift Service Mesh 3.2 includes fixes for several denial of service vulnerabilities. CVE-2026-59873 and CVE-2026-59874 involve the node-tar package, where crafted gzip bombs or malformed tar archive headers can cause denial of service. CVE-2026-59869 involves the js-yaml JavaScript parser, where specially crafted YAML documents with chains of mappings and merge keys can cause excessive CPU resource consumption leading to denial of service. These vulnerabilities allow remote attackers to disrupt service availability without requiring authentication. Red Hat has rated these issues as important and has provided updated versions to mitigate them.

The vulnerabilities can cause denial of service by exhausting CPU resources or triggering resource-intensive processing in the affected components. This can disrupt the availability of the Kiali service within Red Hat OpenShift Service Mesh environments. No confidentiality or integrity impacts are reported. No known exploits are currently observed in the wild.

Red Hat has released Kiali 2.17.12 which addresses these denial of service vulnerabilities. Users should upgrade to this fixed version to remediate the issues. Additionally, to reduce exposure to the js-yaml vulnerability, restrict processing of untrusted YAML documents, implement input validation and sanitization, and limit network access to services parsing YAML to trusted clients. No other specific mitigations are indicated by the vendor advisory.