RHSA-2026:5950HighCVSS 8.6

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.6

Published
March 26, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (6)

CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61731 →CVE-2025-61732 →CVE-2025-68121 →CVE-2026-31837 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61731 — cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-31837 — istio: Istio: Information disclosure and authentication bypass via JWKS resolver unavailability

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:6f8534205103cd6b3b224eeb2bffa006f77b4bdd734ab26964596ed6e853a3df_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:7328a8127aa5ae599de8e21e54c45fd9080a2d42b136d400012d8a2c4b927bc8_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:e3239d0fa9f55834925b4cfe9d4f5a83380f7c85e9ee3441c9b3859e94dac69e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:f24f6e672693c3ee080caa418bc1dc1924921898e07e1aeb06923dd0c195cf30_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:16c4a873fc43fe6e9bd64eb7bca434fdfeab97f4cf722dbacaa97578ffffe79d_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:724bfb04ef262947c8eb357a79743426215d9e48dd5bf5d70c04d0b0748cd6c7_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:803c2b65f22ae7c2e01f0552a69847dda7c993f7abf15954fb043fcf3ddae542_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e997516338202cdbd61076accd9284b07d41a4e5f110acb646dce4d1ecef232d_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1e97793ad79dec9791d67d3ad90ba8b03447daf717c557bbf44baa453a4e1150_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:51ec4d1cb23f20d91565457484ebd0ce27e989a67c4856c44c8621c50ce6f378_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8b9594ddbc8f71aa6d1673c4bc9f770efd8eeb4087314fc7f3359225a2d33e1f_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:ced8fd70a941190d72af02804cd1e3aa55131dd831eb353a46dfe02497474660_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:5396940a090c47c710fae9ccd2539dd2b7a62f3a0e43251f881d7307720b09fd_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7663292b3c063093f7a474443a38b1fa1efcfa4c29d7b65b1de1545ca13f9c60_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:d68017a135a9b3006b792a040e4f397846fa20e383a2fd72241de963553d8d16_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:f19d8eea123addd242941d65c7b9d7f4cf0c8a2009c681ad07a87fb365193a7e_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:209714ace1c29c3b3c55f2dd5f15c988c7b942df623902dd2a49948d28d6a1e4_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:c77d2cd125a4704a19ff51ffdc930365635af1c9784b89748c160401723d0048_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:c8b8f53635b99c58a23f31580cf840a12e8f9866b556ca59f382f1623dca11b3_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:d839d9bbb4faa2b0e7d91a66d85d5d43f8af6cb8681c8bab58fd8e2af1a6ebf7_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:276e03a224db43d8f6669971cac5db6ce99b6a2d7a79e99a599beb57fb04da7d_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:4f5d21e9e0ba777be732fa45bb18e006170edc74f6b796e67c3eabe59b932913_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:63d70dfd91c9cf1deb97db1bf7678f6c04909f182ba4b9de2b54bbb2d5ea3dd8_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:a75a0ac8954c9654263226507088a7969b7f554ba5852bcfcf8a5d64a0d29c92_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:94bd9b7d5013e610f49e7c5376e5c63579a525f2e45e3498908a88b9773c4fcb_amd64 as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Red Hat OpenShift Service Mesh 3.1.6 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)