RHSA-2026:16537HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.3

Published
May 12, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (3)

CVE-2026-27143 →CVE-2026-27144 →CVE-2026-32280 →

📋 Description

CVE-2026-27143 — golang: cmd/compile: possible memory corruption after bound check elimination CVE-2026-27144 — golang: cmd/compile: no-op interface conversion bypasses overlap checking CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2385f2106783290403877b812edea67f861f3ebcc3b6990b070b62e94fc6dbdf_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:555317d71a6322173962d8fc912421edd6d79cd39c55d8cc9a36d1b635f9e099_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:b381c0445928f2bdbdc4ca276b78c16ae1a6e19fca4d66a4d972c323c70570bb_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f977fd5abad71842f5e0e8b805ad4a1003b8dd466a39c314b2a5b9b125e567e1_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:204d15ed8b8bd170daba79fbd99861c61776df5069d2288c64781993daaca2f0_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:2ca3bffba0b8f40fafcdeef1ce73da401175b3ce3893ac176f7f0ce7e9c95ac1_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:42422f5a7654c8897d554844ee2923c58ac3ebf3b23d9c11a582537e67541c99_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:e469542b539575c40b1dd916f0ff1d811c5219fc42cc986f2b67a4b58661b4a7_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:09219031e9c23053aea4a582d12f8feba24acceac0d4525e3a407239492a8810_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:4db6e30d909f0c9605e51f4057284264bcad79a959428ad219b142af21e267e2_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:861d0a488fbced512a91df6e75ae6fd14fbefdeab4b7096b7e43f6f10c35de5c_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:df991997aaf4a8ca43f4938becd43520acd11de06ab101083c0a33486886f3aa_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:1b0467f4bdad9faed783036e6229b56a50111973063bcf4aaf3a602c8eeabe62_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:36d45c48ce39777c0b6229949c14df18b4200b59a581ff642b30f16dfbdab09a_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:50e5ed85ca682a6fefba0fa0138ef2aedf845fd2457c5beaf25a100f814b56c7_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:ae3beff03ea771b020631e5bc7e778c84e8a0cdeffb10af5d3f8f6409b85206d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:40f40b8b068f72525ffd293d13d24acd5172c000691cbedd7e398202872bef1c_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:7015daf9e74ca4bfece7ddbc1766a18d401fd0f90cd4a9b93d6c397cabd9c35f_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:9a33d18d2482eeb76a7ebd10404e54d5556cdf98d0f4fdbf54facda4ce3a8fbf_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:eaaccb1bf78df88abc6f2b16d440b24773240701aa6fef039e776e82481bc159_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:23257a094ce3fd6ec95bae0d8185ad7e17a5bf838bfc81a50375207e9a309c2d_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:3ca7c5243b014d9924fd98aa03756e52839c4ba80843b1a08563509bf98d06d8_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:5684e84fb340fed6333e2f41a2a4aaa4612aaf77bb2403bf17f117d5177ad389_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ef9ab6a6c108014df3a755c4b8b72eb9dce20a13e287ecb139100188b4d8678a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:f00ee1b029961c307f294d3265699cacb16a9e055e65acabcd996b8ab479ee49_arm64 as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Red Hat OpenShift Service Mesh 3.3.3 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3 Workaround: To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur. Workaround: To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as 'any' or 'interface{}') just before a move operation, refactor the code to use concrete types or explicit pointers instead.

🔗 References (10)