RHSA-2026:92497HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.11

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-94448 →CVE-2026-111943 →CVE-2026-78663 →CVE-2026-78667 →CVE-2026-94439 →CVE-2026-97030 →CVE-2026-97031 →CVE-2026-97032 →CVE-2026-56857 →CVE-2026-56866 →CVE-2026-78669 →CVE-2026-94440 →

📋 Description

CVE-2026-56857 — os: golang: golang: Directory traversal via Windows junction handling CVE-2026-56866 — net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections CVE-2026-78663 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-94439 — net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94448 — html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals CVE-2026-97030 — html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97032 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:20fd460c0542a07873fa0ae7fa1cf7eb6507949ebb6ba871a05adb71dc371fa0_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:284bddca8b04dacc43c2f89c887b82162fe1b7f6626d493c159b6a23395daab7_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:59b46850e8102238d1f36a4266433bce543402e0a3603b5975c2bdb80eaf4452_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:8fb9d153872ab4406ff688d68191ba73efc11ad8ffd03deacfd4cd5905140da2_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:16958479a0d38dd5bb5a2e00dfa50b47595e23eb9d8df9c2a0493ed46ce2717b_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5979df99566e50026730ee1abdebc35d0cf905b0406b5bd3b95cf920cf5766d7_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:670717cf063bae2e702763228cc58b10c423f5925bd061d3732f0d4036264e14_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:e2dcbbd61b94a9406eb032d0c205d0c5a4027c750e0d278b469bb72cf9cb87d7_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:03d80a3f6cf7cac9043a3d6c857525d66cfd1804e65b24f998b2ff6869379a08_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:4a26b7fe944bb7c2434c7e54d1f18dba4f6524a4dfba291f10f41cfa83f3f69c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e1a0426b5d52017c4628af4790f0e02a22adeb9d3f0202b9bc888833dd581979_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e28dfe5c3883157450d7d2f2d23e0f420f9e5dafff376b739eee50dd61175ec0_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2a86224025b5ab06efbce1662de58d2ceb933833de4f0d2473c4dca1855e1472_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6eb8d8ea6ab4152b8b4e62598877afb0364b04c6748f6af3fa30878a0c9649b4_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:ac2d8a8ae6a4e0d4f8cb38ed72edc0277a77aff50ae19887e0ab7dfa1186147b_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:e2f54932b61cbf5862d00619c000b52b2a730bfae86c803c0e0bdd35f7f12d0c_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:0f534e90328843a768082bac4fdc8af9c29fc431bde24a7d60f9b0fbbeb950fa_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3f50266039e0a7eccd4a59076092cd20868c5ab7c5c19f386270070d435099f4_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:51dc10174b1453233d78b4ad553ae9d8efe6bbc5db008ef19bc4bd2801588d82_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:a3703d4d85af9d8d4f7f8ac637623cf1a75a06f8056e09b89b6022d2988eff0d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:00800049b9c3edcf1f54be48a93b34793664bd96ed9dfccbbeebf38ab6a836cc_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:296895ab52d3c1618a70565e0023c0b768c521811a13f7e640727ae3d4d91b8b_s390x as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4e7f8a5a6a26ac5bf5fd946afdb4e028aba81bfb50884e5171bc64dceac38f57_amd64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:69ab3d4bbac3633eced6a4876f9eab70d32d29ee59e49b3391980b9b9f335697_arm64 as a component of Red Hat OpenShift Service Mesh 3.2
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:d649dbae6c56817b00a2fdae56ac2e87da8084b5d4a4548abf3eb798a32fdf42_ppc64le as a component of Red Hat OpenShift Service Mesh 3.2

✅ Remediation

See Red Hat OpenShift Service Mesh 3.2.11 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.2 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)