This Red Hat security advisory for OpenShift Service Mesh 3.2.5, which is based on the open source Istio project, addresses several vulnerabilities: CVE-2026-27143 involves possible memory corruption after bound check elimination; CVE-2026-27144 involves a no-op interface conversion that bypasses overlap checking; and CVE-2026-32280 involves a denial of service vulnerability in Go during certificate chain building. These vulnerabilities affect multiple components including istio-rhel9-operator, istio-proxyv2-rhel9, istio-pilot-rhel9, and istio-cni-rhel9. The advisory provides fixes for these issues in the 3.2.5 release of Red Hat OpenShift Service Mesh. The vendor advisory does not indicate any known exploits in the wild and classifies the security impact as important.

The vulnerabilities could lead to memory corruption, which may cause instability or unexpected behavior in affected components. The interface conversion bypass could allow unintended behavior by circumventing overlap checks. The denial of service vulnerability in certificate chain building could disrupt service availability. These impacts affect the security and reliability of microservice architectures managed by Red Hat OpenShift Service Mesh 3.2. Without patching, these issues could potentially be exploited to degrade service or cause application failures.

Red Hat has released OpenShift Service Mesh version 3.2.5 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. No additional mitigations are specified by the vendor advisory. Patch status is confirmed as fixed in version 3.2.5. Refer to the official Red Hat advisory RHSA-2026:16508 for detailed update instructions.