RHSA-2026:5952HighCVSS 8.6

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3

Published
March 26, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (6)

CVE-2026-31837 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61731 →CVE-2025-61732 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61731 — cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61732 — cmd/cgo: Go cgo: Code smuggling due to comment parsing discrepancy CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-31837 — istio: Istio: Information disclosure and authentication bypass via JWKS resolver unavailability

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1ad57736249ed843127edf74f765e810ee91f3e9196c0402ecf6199c0b0eeaab_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:1ece317e94a6b73c5654b836ada2b6ea181c92530b2c8c406c4766499057e8c9_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:4a5e31af5fa9740c6567ce5e6510842a989df5a25435521bdeb87a6962bfb3d3_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:90e9ef5b9db44a7f18bcdfaba6851c89138577636cb765de938bdf0e68d296be_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:06e423f764c1714392925c3c3d63b524b9751b7c876e09df11f71c2b860185c1_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:157774fbb36e6924c1b8dbdbace1d97f33070bc4af7e29e999ea182f6fcc87c0_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1dcb1fad2fa5db4c4c36ad42166b47c86015169bd570cdb6af9fe18717bd93b2_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:226cdb05c3583a75732796acb0fa9afe0771267e9575c0585b0c222141736e0a_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:037536592c20bc7a10063a371a845a1805dd2bb59bd04ef65cff985fdb77724f_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:5728f8611c4d586ab1ab080ee3c8038140b2e4ff6f3037263c92b39e7053b30e_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b8141f34bc91435d174203b914db8b452c7295d76268b4cd8a18d3cc371eff07_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:eba1f0afeb06ac3eba3c1e35a2045e25e60a37b1a542ef393f7d8d6382030af8_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:3f0bff703e601453f75c7eb46da31400a25267bd748aa7337ed9bcc30fc552e6_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:783c436fc96986ab1e5c5869139e3a2d31fe1e1796083c28a743c1900378572e_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9b8c6dc0678602cfb16a347ec26813758267a924f0a4a7189f30b6dd9c2ead91_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a65212d6c07f11e855e60c2027076351947fa2d9a4a725dab519afa796615d3a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2224fc1667fbac0728e14e7c99c75a28e2e44e76a3e922c26216d5341283b1d3_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:6adba5976577e2ae99aad55a8de7a7603e0b9546423af16020d4c34ac125c83f_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dae6eb72e8a8aa989ec2919e763c79273dbd48fc10c10917095276ec0db54e09_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:e1de1bc5f4472757cd9dd1e87de88fc54cdde8bbb9a4fd2245388dc3076efada_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:915c426f6d9e02f951d13df06a3e2398a9cc0cdaae6f4deb71aaaf280ad55421_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:39eeec9d30a317cc703a13389d76e15f641c7d67bec0528fd99a5c8c015c23f9_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:654d5bcebc86748c735639eb978bcae7cd4e0152eaded93885d04677c8164f1a_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:888c599cb37535870bf8256831eb81c9a27ec6da5dbd433f4363ff3109195957_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:c99eadf319dd88c8a7e6e2201dd749f1f631a60d1bc0cc683cf83fb14f01317b_amd64 as a component of Red Hat OpenShift Service Mesh 3.2

✅ Remediation

See Red Hat OpenShift Service Mesh 3.2.3 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (16)