Red Hat OpenShift Service Mesh 3.2.5, based on the Istio project, fixes several security vulnerabilities present in earlier versions (>=3.2.0 <3.2.5). The primary vulnerability (CVE-2026-27143) involves a flaw in the Go compiler's cmd/compile package where integer overflow or underflow in loop induction variables is not correctly checked, allowing invalid memory indexing and possible memory corruption at runtime. Additional issues include no-op interface conversions that bypass overlap checking (CVE-2026-27144) and denial of service in certificate chain building (CVE-2026-32280). These vulnerabilities affect multiple Istio components within the service mesh, such as istio-rhel9-operator, istio-proxyv2-rhel9, istio-pilot-rhel9, and istio-cni-rhel9. The vulnerabilities require specific conditions to be exploitable, including the presence of loops using induction variables as array or slice indices and the ability to cause integer overflow or underflow. Red Hat has released version 3.2.5 with fixes for these issues.

The vulnerabilities can lead to memory corruption and denial of service within the affected Istio components of Red Hat OpenShift Service Mesh. Exploitation requires specific conditions, such as loops with induction variables used as memory indices and the ability to trigger integer overflow or underflow. The impact includes potential compromise of confidentiality, integrity, and availability of the service mesh components. However, the overall severity is rated as important/high by Red Hat, with moderate exploitability due to the complexity of triggering the conditions.

Red Hat has released OpenShift Service Mesh version 3.2.5 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. Additionally, to mitigate CVE-2026-27143, it is recommended to strictly sanitize and enforce bounds checking on any untrusted input that influences loop counters or memory indices to prevent integer overflow or underflow. No other specific mitigations are indicated by the vendor advisory.