Red Hat OpenShift Service Mesh 2.6.14, based on the Istio project, fixes several vulnerabilities in the proxyv2-rhel9 component. The fixed issues include CVE-2025-61726 (memory exhaustion in query parameter parsing in net/url), CVE-2025-61728 (excessive CPU consumption when building archive index in archive/zip), CVE-2025-61731 (arbitrary file write via malicious pkg-config directive in cmd/go), CVE-2025-61732 (potential code smuggling via doc comments in cmd/cgo), and CVE-2025-68121 (unexpected session resumption in crypto/tls). These vulnerabilities affect microservice architecture security by potentially enabling resource exhaustion and unauthorized file writes. The advisory references updated images and documentation for applying the fixes.

The vulnerabilities collectively could lead to denial of service conditions through memory exhaustion and excessive CPU consumption, as well as potential unauthorized file writes and unexpected session resumptions that may undermine the security of the service mesh environment. The impact is rated as high by the vendor, reflecting significant risk to affected deployments if unpatched.

Red Hat has released OpenShift Service Mesh version 2.6.14 which includes fixes for these vulnerabilities. Users should upgrade to this version following the official Red Hat OpenShift Service Mesh 2.6.14 documentation. No additional mitigations are specified beyond applying the update. Patch status is confirmed by the vendor advisory.