RHSA-2026:3556HighCVSS 8.6

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.14

Published
March 2, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (5)

CVE-2025-61731 →CVE-2025-61732 →CVE-2025-68121 →CVE-2025-61726 →CVE-2025-61728 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61731 — cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products9

  • Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:25c1cd1facbe56ad4974d8c66a6bfb64cf982d244ff22e857a0333a39ea818e0_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:53ad217917241b2a4b87cb81e54cb4f2618cede3c20613acec84939a639a4514_amd64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:94e7ae70d26390f684b96b620f2f0d4375e6a447885ba481454a760f14f4d77e_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:a168ca48217a77eb0f770779e33d5d71a313efb3cb06d01eb4050e5d04a47864_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/proxyv2-rhel9@sha256:14dcee73384f17ebe545788b8cf1dceec3492ddd77d6b82157dbc5076cfaaa91_ppc64le as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/proxyv2-rhel9@sha256:47cab522c64f29015b2b675db01ddb8311f1f86633a6172f5bdb5236ddc71110_s390x as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/proxyv2-rhel9@sha256:efd2df1b504c10b74f5960eab43edd126f36ae4adccbc61c881e08e64c758e2d_arm64 as a component of Red Hat OpenShift Service Mesh 2.6
  • registry.redhat.io/openshift-service-mesh/proxyv2-rhel9@sha256:f49b0ec7e087153e981b53d90a1eb32155f703c59c0e3ba9cd1427dd3defcf7d_amd64 as a component of Red Hat OpenShift Service Mesh 2.6

✅ Remediation

See Red Hat OpenShift Service Mesh 2.6.14 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/service_mesh/service-mesh-2-x Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (14)