This advisory covers multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.6.14, which is based on the Istio project. The vulnerabilities include: (1) unexpected session resumption in crypto/tls (CVE-2025-68121), (2) potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732), (3) arbitrary file write through malicious pkg-config directives in cmd/go (CVE-2025-61731), (4) memory exhaustion during query parameter parsing in net/url (CVE-2025-61726), and (5) excessive CPU consumption when building archive indexes in archive/zip (CVE-2025-61728). These affect multiple components such as istio-operator-rhel8, istio-cni-rhel8, pilot-rhel8, and ratelimit-rhel8. The advisory references Red Hat OpenShift Service Mesh 2.6.14 as the updated version addressing these issues. The vulnerabilities are categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-88 (Argument Injection or Modification).

The vulnerabilities can lead to resource exhaustion (memory and CPU), arbitrary file writes, and unexpected session resumption, which may compromise the stability and security of the affected OpenShift Service Mesh components. These issues could potentially be exploited to disrupt service availability or manipulate system behavior. However, no known exploits in the wild have been reported. The overall severity is assessed as high due to the range of issues affecting critical components of the service mesh infrastructure.

Red Hat recommends upgrading to Red Hat OpenShift Service Mesh version 2.6.14, which addresses all listed vulnerabilities. The advisory does not provide separate patch links but directs users to the updated version documentation. Users should apply this update promptly to mitigate the risks. Since this is not a cloud service, remediation is the responsibility of the user. Patch status is confirmed by the vendor advisory indicating the update to version 2.6.14 as the solution.