RHSA-2026:65121HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.4.2

Published
September 8, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (18)

CVE-2026-73549 →CVE-2026-73553 →CVE-2026-56853 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-73513 →CVE-2026-73548 →CVE-2026-73552 →CVE-2026-50572 →CVE-2026-56858 →CVE-2026-73511 →CVE-2026-73550 →CVE-2026-73551 →CVE-2026-33818 →CVE-2026-39825 →CVE-2026-56859 →CVE-2026-73546 →CVE-2026-73547 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39825 — net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls CVE-2026-50572 — envoy: envoy: ext_authz use-after-free after rejecting an HTTP request CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-73511 — envoy: envoy: path matching bypass via per-segment parameters not stripped by router CVE-2026-73513 — envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free CVE-2026-73546 — envoy: envoy: stored XSS through dynamically generated stat names in admin interface CVE-2026-73547 — envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header CVE-2026-73548 — envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests CVE-2026-73549 — envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters CVE-2026-73550 — envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits CVE-2026-73551 — envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters CVE-2026-73552 — envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values CVE-2026-73553 — envoy: envoy: RBAC authorization bypass when path-parameter stripping is enabled

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:515be58d5e748a866232759c832603a490dae81997156a3e52d8cd6382bf3c43_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:819e89709e4d96a5f30a0a780868dbeceeee70f25000c96cf0a1eb2d814d372c_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:82df99a52ead267acbc12ad7715faf7bef62e19d17d3e13e5a98869d0778598c_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:eab4d432687f63afc6abd227cb2a2c0267d95e438148ae37de4b8d71f8b8ce24_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:14d5f781aebef126bdc14470e242a620de6de41544652f91db7de10df14b5fcb_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1eec790881023bfbda086673555bc6dd7de66d461756ba3618a200ab43d9742c_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:3305a36503024ec1f93b5569c59e28339b9725d8ec866017292e234b9fabb6e1_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:53c6ac39bd3d9efbb73bd461a43b613ac4d947def7d9072a02ed503717fe2c65_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:05b1806bc1770750c57d3413fade31100e80565dbe670c1a3b1bc556d886ad1a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:66c6fd7c14dda3e35f2ddf1cc19d2e0280a5d6400fb2513d17fdff493544b510_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ab0cd35b02cbfac2009ff348ec8ecf6ed849ac0858702823032c3c46a307e334_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:c7c1fa83732dd8bf2409000dd1a20877acd49fe648095d55a49fccc722da7084_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:09f469af534a58085c5c0f3cbff6d07e8cb0520d41e72af17589cfc9219ba9f6_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:500a26ca7fa58aab950aaa6b76c1b34bffd2d5bf37a7598a61c9afff2f9d2af9_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:84aa1fc478141ad70c36e9f0e7bd371b35ff12a23229a3b9551b4858f4b52c88_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9e9dc9721b6ca5ee224e8748032edf69b6106192e72766ab950fa923e2b1da22_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:557c959e1791053324497a0f276a84451f8f6e7c00bfcb3bcb1c5dde57f3f652_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:9237ce3bb633b6ac6cb881bbf8aaacb5e01cfa1d280e3a1f0dfeed61f3541cba_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:d12d72d74232a9b161ff251310ac0a8501637e37ea447bbc56aa692208f0d4fe_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:ee24adfa657682a69b72250f6da24c60daeee35b0ee9b96704ab7e5bc6afc7b4_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:b1fb2de6650acf051c4d6753d909fee9dd3f1cb5a0f81b818fd88259b2b3efdc_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:142eb9e84c5bb74802ff5845036b5c6d16a11ea3a2536a6f46087d190c78062e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:9ec3d1dcbbffe6b151d13d523b89b5b31d3990b3bbb4981bb0f1bfddfae0c9ba_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:a4313ffe78162e825285e5d7730c3064116087a63f31c1ecf5aac2ee1b34aca9_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:b681608d9dc6ed8d2d08f59ff68ec316326139277642a533da2860a70292a59b_arm64 as a component of Red Hat OpenShift Service Mesh 3.4

✅ Remediation

See Red Hat OpenShift Service Mesh 3.4.2 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering. Workaround: Ensure upstream HTTP/2 clusters rely on the default nghttp2 codec rather than enabling the optional oghttp2 codec. Where possible, restrict proxy routing configurations to communicate exclusively with trusted internal backend services. Modifying upstream cluster configurations or rolling out configuration changes requires restarting or reloading affected proxy pods or services, which can cause brief connection interruptions. Workaround: To mitigate exposure without patching, apply the following operational and configuration controls: 1. Restrict administrative interface reachability: Isolate the Envoy administrative interface (typically listening on port 15000 in OpenShift Service Mesh deployments). Ensure it is accessible only via localhost or strictly controlled internal networks by applying OpenShift NetworkPolicies or firewall rules. 2. Avoid interactive browser access to HTML stats: Do not render `/stats?format=html` in an interactive web browser. Use automated metric collectors or command-line tools to query text or JSON representations instead (e.g., `curl http://localhost:15000/stats` or `curl http://localhost:15000/stats?format=json`). 3. Reconfigure dynamic metric filters: Avoid configurations and extensions that generate dynamic statistic names based on untrusted incoming traffic, such as disabling `stats_for_all_methods` in gRPC stats filters. Caveats: Restricting the admin port may disrupt external monitoring tools or custom diagnostic automation that query the management interface. Reconfiguring Envoy proxy settings requires restarting or reloading proxy instances, which may briefly interrupt active network sessions. Workaround: To mitigate this issue: 1. Remove generic, non-WebSocket HTTP upgrade configurations from routes or listeners if custom protocol upgrades are not required. 2. If generic HTTP upgrades are necessary, prevent upstream connection reuse by configuring `max_requests_per_connection: 1` on the affected upstream cluster. In OpenShift Service Mesh, configure an Istio DestinationRule for the target service: ```yaml apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: disable-connection-reuse spec: host: <target-service> trafficPolicy: connectionPool: http: maxRequestsPerConnection: 1 ``` For standalone Envoy instances, define the setting under the upstream cluster configuration: ```yaml clusters: - name: <upstream-cluster> max_requests_per_connection: 1 ``` Caveats: Setting maximum requests per connection to 1 terminates connections after a single transaction, which can increase latency and CPU utilization on proxies and backends due to repeated connection handshakes. Warning: Modifying proxy configurations will initiate a configuration reload and may require restarting proxy pods to flush and terminate existing upstream connection pools. Workaround: Modify Envoy RBAC configurations or OpenShift Service Mesh authorization policies to avoid negative matching logic that relies on regular expressions for HTTP headers. Instead, configure policies using positive allowlists or employ non-regex matchers, such as exact, prefix, suffix, or contains matching rules, which evaluate header values reliably. Caveats: Altering existing access control policies can modify request authorization decisions. Thoroughly test modified policy definitions in a staging environment prior to applying them in production.

🔗 References (21)