RHSA-2026:92516HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.4.4

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-78667 →CVE-2026-78669 →CVE-2026-94440 →CVE-2026-97030 →CVE-2026-97032 →CVE-2026-111943 →CVE-2026-56857 →CVE-2026-56866 →CVE-2026-94439 →CVE-2026-94448 →CVE-2026-97031 →CVE-2026-78663 →

📋 Description

CVE-2026-56857 — os: golang: golang: Directory traversal via Windows junction handling CVE-2026-56866 — net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections CVE-2026-78663 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-94439 — net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94448 — html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals CVE-2026-97030 — html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97032 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0502a19b58e6bed9d378f258fb8bb10cc70f7dcadff2ba7ddba99f2443001ec5_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:6a9250c99b0f1fe63f7d2dc8622d705f9dfc5881a4f669022b8c59522b70a589_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:9f47ca3cf0552701edc7c2a2a59f96ed3158e009609c3e3b7ba92619bd8917f9_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f261b64c06829d1a9c43fdc0884f1c3b99085134054f8f6f453c13d8dabe1f3b_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:3897660bdac93ee7a83057f120e079264b76dcd74c0fb02ba1f628cb97ca0715_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:917ce389b6b9aa484cf085c50e027a14092cd87f33c33c55a79d2c2cdfa27f8c_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:9ae3841d17e309f51534d7f566beeb2cca6fe49337a4f1e2a443a7a5a8956a88_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f09ed5fac02f548d59613627d7e3b0431a1ad5d53155a2ee70d38cd1b099796a_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:0c24bfeda3d3ae505d9f8a101388cf49f4987f4ae341a674ac04c219788fdfbd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1b234384c3c7fa70506110ece3fbc416b2550e59c2c9cf51b0419daed517c16b_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6b98c9c091f2e74087fd5badfc4a5bd94c2187664c641f9ee154ed1318880c95_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:b6a0242256da343d455c15f83977e9aa89cab91b481f2561f3ee82f415d3996e_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2e0f33cfaafe7be8e7bbaf260ae3c52e0f88eb120e4e7f338ae8f3de85314769_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:50121e7bfadd1c9d2574eaba77051720955e00731da96c67ef6f5e7d4d8e0d56_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:734e633355998965d02bde27ea4dd45addb38819e2f4fe99e276d38b349d8213_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:ea320145af392e8f269313d48747bacd89b4742b1e66494946e4b512fb24e418_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:0d033cbf1da65feb8e1306fdbdcd944a3d81aa5025cb6d21b3b2ada2f3155b07_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:5fb40fe3777e1b0c2a7893432573f1f624821f973fbcddcbb83982043c8e9b92_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:9de8e5988ebbc9b7ebf56a7c4b3212949027764a0c63a1ad6c2722acbafd0805_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bbc7f1026b5f36da7a19b64bb748a3d8718670187152f7d840999538cec723e0_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:05624655e4bb7c0a819826c99aac68c93f26abb1db459a2ffea1ad75aa0419e3_amd64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:136e7c4dd7018d31f4018e64bf2c09353298ea4768bd66f910a7507a7c188ed7_arm64 as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:415399c0a4f59790a7dff7cd81d155dd599c65d8e8867bc0276a7ae7117d98dd_ppc64le as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:50c50d46e37e7d797994543dbafe980061cc72121b2fcf81b030da9c10de3521_s390x as a component of Red Hat OpenShift Service Mesh 3.4
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:a39991a637992acfef7ec55c0409fd3383119d42c4302c9942f825762b552378_amd64 as a component of Red Hat OpenShift Service Mesh 3.4

✅ Remediation

See Red Hat OpenShift Service Mesh 3.4.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)