Red Hat OpenShift Service Mesh 2.6.15, based on the open source Istio project, fixes multiple vulnerabilities across its components. CVE-2026-25679 addresses incorrect parsing of IPv6 host literals in net/url, affecting istio-operator-rhel8, istio-cni-rhel8, pilot-rhel8, and ratelimit-rhel8. CVE-2026-34986 involves denial of service via crafted JSON Web Encryption (JWE) objects in istio-cni-rhel8 and pilot-rhel8. CVE-2026-32280 is a denial of service vulnerability in certificate chain building impacting istio-rhel8-operator, istio-cni-rhel8, pilot-rhel8, and ratelimit-rhel8. CVE-2026-27143 concerns possible memory corruption after bound check elimination, and CVE-2026-27144 involves no-op interface conversion bypassing overlap checking, both affecting the same components. These vulnerabilities collectively could impact the stability and security of the service mesh environment. The advisory references Red Hat OpenShift Service Mesh 2.6.15 as the version containing these fixes but does not provide explicit patch links.

The vulnerabilities include incorrect parsing of IPv6 host literals, which could lead to incorrect handling of network addresses. Denial of service issues via crafted JSON Web Encryption objects and certificate chain building could cause service interruptions. Memory corruption and interface conversion bypass issues may lead to instability or unexpected behavior in the affected components. No known exploits in the wild have been reported. The overall impact is a high severity risk to the availability and reliability of the OpenShift Service Mesh components if left unpatched.

Red Hat has released OpenShift Service Mesh version 2.6.15 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. No additional mitigation steps or temporary workarounds are indicated in the vendor advisory. Patch status is confirmed by the vendor advisory indicating the fixes are included in version 2.6.15.