Red Hat OpenShift Service Mesh 2.6.14, based on Istio, fixes five security vulnerabilities including CVE-2025-61726, a memory exhaustion vulnerability in the Go net/url package. This vulnerability arises because the package does not limit the number of unique query parameters parsed, allowing an attacker to cause excessive memory use and denial of service by sending HTTP requests with many unique parameters. Other fixed issues include unexpected session resumption in crypto/tls (CVE-2025-68121), code smuggling via doc comments in cmd/cgo (CVE-2025-61732), arbitrary file write via malicious pkg-config directive (CVE-2025-61731), and excessive CPU consumption in archive/zip (CVE-2025-61728). The advisory references Red Hat OpenShift Service Mesh versions >=2.6.0 and <2.6.14 as affected, with the update 2.6.14 providing the fixes.

Exploitation of CVE-2025-61726 can cause denial of service by exhausting memory resources in applications using the vulnerable net/url package to parse HTTP query parameters. This results in application crashes or unresponsiveness, impacting availability. Other vulnerabilities fixed in this update address potential code execution, arbitrary file writes, and excessive CPU consumption, which could lead to resource exhaustion or other impacts. There is no impact on confidentiality or integrity reported for CVE-2025-61726. The overall severity of these combined issues is rated as high by Red Hat.

Red Hat has released OpenShift Service Mesh version 2.6.14 which includes fixes for these vulnerabilities. Users should upgrade to version 2.6.14 as soon as possible to mitigate these issues. No practical mitigations other than updating have been identified by Red Hat. Since this is not a cloud service, remediation is the responsibility of the user. Monitor Red Hat advisories for any further updates or guidance.