This advisory covers several vulnerabilities in Red Hat OpenShift Service Mesh 3.3.x, which is based on Istio. CVE-2026-27143 involves a flaw in the Go compiler's cmd/compile package where integer overflow or underflow in loop induction variables can lead to invalid memory indexing and potential memory corruption. CVE-2026-27144 concerns no-op interface conversions that bypass overlap checking, potentially compromising memory safety. CVE-2026-32280 is a denial of service vulnerability in certificate chain building when using Go applications. These vulnerabilities affect multiple components including istio-proxyv2-rhel9, istio-pilot-rhel9, istio-cni-rhel9, and istio-rhel9-operator. The issues are fixed in Red Hat OpenShift Service Mesh version 3.3.3.

The vulnerabilities can cause memory corruption and denial of service in affected components of Red Hat OpenShift Service Mesh. CVE-2026-27143 can lead to memory corruption if an application uses loop induction variables with integer overflow or underflow, potentially allowing invalid memory access. CVE-2026-27144 can bypass memory overlap checks, affecting memory safety. CVE-2026-32280 can cause denial of service during certificate chain building in Go applications. These impacts can affect the stability and security of microservice architectures using the affected versions.

Red Hat has released OpenShift Service Mesh version 3.3.3 which includes fixes for these vulnerabilities. Users should upgrade to version 3.3.3 or later to remediate these issues. Additionally, for CVE-2026-27143, it is recommended to strictly sanitize and enforce bounds checking on any untrusted input influencing loop counters or memory indices to prevent exploitation. No other specific mitigations are indicated by the vendor advisory.