VDB
RHSA-2026:49681
RHSA-2026:49681
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:7afedef5bd22487488160bdd97fbe1b0bf8648367bb47b255bf6c6834e62355e_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:e35a7f1774bd5005171c9e1fb717eb73a9d11e8c1aa4e2f606fbd1331e147805_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:bba1360a424f5aac9beffc5542cc8b465e0e820bf045bf74e6604455c52ce833_s390x as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7a49cfc03fd384d8cedb3b7324bff485138fc6bcb99c608d61215248ade5b10b_arm64 as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:504dc6ba7a0458296699f5807a27fab2ad8d32dbf22596dd8f1429d22f547f31_s390x as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:75b1c9d084f5cfd18aeced0d801bdff647bce79b83cfa27d3e2ba7954515ced0_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:b037f3f76e9c0c3c957eed7e07a156dd48c9e4a85cf5e8c73ea58ab4dcd43f23_arm64 as a component of Red Hat OpenShift Service Mesh 3.2 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:9cd865290c175e0d49596f1995ea071ac9531205bf54799e67c5840154cb23a9_amd64 as a component of Red Hat OpenShift Service Mesh 3.2 | * |
Timeline
- Aug 3, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49681 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-59873 advisory
- https://access.redhat.com/security/cve/CVE-2026-59874 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49681.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498122 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59869 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59869 advisory
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 advisory
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 advisory
- https://github.com/nodeca/js-yaml/releases/tag/3.15.0 advisory
- https://github.com/nodeca/js-yaml/releases/tag/4.3.0 advisory
- https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498120 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59873 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59873 advisory
- https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3 advisory
- https://github.com/isaacs/node-tar/releases/tag/v7.5.19 advisory
…and 7 more