RHSA-2026:92509HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.9

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-78669 →CVE-2026-94439 →CVE-2026-94440 →CVE-2026-94448 →CVE-2026-97030 →CVE-2026-56866 →CVE-2026-97031 →CVE-2026-97032 →CVE-2026-111943 →CVE-2026-56857 →CVE-2026-78663 →CVE-2026-78667 →

📋 Description

CVE-2026-56857 — os: golang: golang: Directory traversal via Windows junction handling CVE-2026-56866 — net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections CVE-2026-78663 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-94439 — net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94448 — html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals CVE-2026-97030 — html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97032 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)