VDB
RHSA-2026%3A3109
RHSA-2026%3A3109
PUBLISHED
CVSS 7.5 HIGH
A denial of service flaw has been discovered in the Axios npm package. the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:eec3c51f0d991ad8b8b387adf284ded13d15a4db33b151a4ae4949716c6b2479_s390x |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:5dc63a919b903103abba9331290438bb13864ae629078e0a698b23b57e0d7aa4_s390x, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:44f463726ee4bb36daa3f35b7322c9a51f964f736509a20bed34411dd5aa6914_ppc64le |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:37b39a062649870a3b547e9310efbb5f720d413ccd6893c1ac660138d4388bf9_ppc64le |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:250cf403e11be8c7ed06e4660e8ed07c0a3b1d86d720735629fc28794d656ea2_arm64 as a component of Red Hat OpenShift Service Mesh 3.2 | *, *, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:c772061859ad2bea98022c4a7e20dd731c5e468d8a91cd57576b0037cc500707_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:078ecde6a72a12099911e201456d8ffd09b4c21796b6c54fa8295600a974790c_ppc64le |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64, registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:6fe6ac64e2216011a4880a72adfcf1ae853845df3bd125a01899f24bedbc7845_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3dfca839b5427175801d0cc515dc36bf85e08c3ffea98aff51f703ada9821367_amd64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64 as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64, registry.redhat.io/openshift-service-mesh/kiali-rhel9-operator@sha256:3416a57b9f3d949a27d8b086bda2a092398d8bb83c12c1ca69fa72d41611f4be_arm64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | *, registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64, registry.redhat.io/openshift-service-mesh/kiali-operator-bundle@sha256:7a78b11e11473268cf0d31a0e7644995ded09e22419fc8f5400e54bf85acbc6a_amd64 |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64 as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64, registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:8017912e8032510d47f667b8d17ddff6ff5a84576df2d484d09a6b0747454c4e_arm64, * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x as a component of Red Hat OpenShift Service Mesh 3.2 | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3fff336de41113a2fa449e12c7c3023c1569a4085c9ed3d58f588401a0638e49_s390x, *, * |
Timeline
- Feb 23, 2026 CVE Published
- May 4, 2026 Distribution Patch
- May 4, 2026 Distribution Patch
- May 4, 2026 Security Advisory
- May 4, 2026 Security Advisory
- May 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:3109 advisory
- https://access.redhat.com/security/cve/CVE-2026-25639 advisory
- https://access.redhat.com/security/cve/cve-2026-25639 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3109.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2438237 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25639 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25639 advisory
- https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57 advisory
- https://github.com/axios/axios/releases/tag/v1.13.5 advisory
- https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433 advisory