RHSA-2026:5948HighCVSS 8.6

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.9

Published
March 26, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (6)

CVE-2026-31837 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61731 →CVE-2025-61732 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61731 — cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-31837 — istio: Istio: Information disclosure and authentication bypass via JWKS resolver unavailability

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:aaffe72a3ceaa3ee1984579e52c8c9a15a1e45b55d53c8c00e2be62cbcd21b62_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:b1f48cab9351f5a744c0a2839a3e4cffef152836bf3072511c858dafbed968bd_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:da9731b2c26cb10466f835467e0c25fa2483ca260e2f31e92c2783cf73fce074_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:efdcf5819964e4edf19ec04f7b496d84bb705b4b0d2a9c7f8220ea2937d09d36_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:35b0638bd3e1f638b2493f92eca8125f6e74038bf43565c8c97dea61f016393d_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:396e3ba2ed81cb48d2d0ea4ec0373edd6f80fece16034e4dfe223ef7dd198fcd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:7a720e7d0cffeb4ceb132f928774c85d43a9adb01eddfd5dbaa9d747115b4357_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:dcd2685d0f51bd9654e77891351273f5f9f93161efd413925c3d0b96b3bdbf0f_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:041058c4ed2cc602c6a0fc41205de07791679bdf0511650fabb1a6251d5aff13_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8a23e3f64b7d99ff915b4dcbdc9e6efa3364435032b458cba0ee85951df428da_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:cf5bb9941b6c806906e594b1cac7c73b94b91674956913b5f4c6f27be9d8faac_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:ef560e57543bec7d17f46e7baede5f906a5feb1d59feabca310feada79180b85_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:620f6be30fde3c8a5416f94405f520902f47989d431904963c308885d59d0e42_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:62a7fccbf538f3512a128df0affa07ea332892512ca65c81546115af1d7ec124_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:84c065882a22024d24031bb1ae81e57a2596e51e84a94cc0132950448d465b50_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:9dda1ca14a4d44819498e5e00470bedf540ba7cd5a6be015e47bbf1fe5aa8ca3_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:473c10e26272fee90233bb95c1c434f45c4fce2170ee99ff674c2d56642c2ef4_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:8238270e2aab1a016cd4e66de470f499e9f33e95a2547dd72722814e8b71063e_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:8e17971e0f5d14b920841b11b2d084a1275bb942566edde1ac4789452ee92bd2_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:efc87388d29385d36a26a19da1adb52bd9ef8dea42503b409d1f3d25769c3e76_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:9d1c49aac324418a6c9422990e7e83aaffbd2bdf73cd37ab692ae19a6e675a18_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:e67e1607b7d2a354399aa5c32ad7e776650f95e978591f3e6fd80b335a0dd3e9_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:f9399b41994032dbf514eb7ab8576614e7139a35af239efc1f05de497b9755d1_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:fe35fc6ea8320c1d0e8ee0712788879daee23d4cea6b970237375e264344ddd0_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:6067e8bd752fec6a4c9791b5416feebd3755e812677393c1c2ad4746f5aced5e_amd64 as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Red Hat OpenShift Service Mesh 3.0.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)