Skip to main content
EPSS 2.1%top 19%

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3

0
High
Published: 03/26/2026 (03/26/2026, 15:03:15 UTC)
Source: GCVE Database
Vendor/Project: Red Hat Product Security
Product: Red Hat

Description

Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * Updated to Istio version 1.27.8 * Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585) Security Fix(es): * istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837) * istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)

Affected software

Affected versions
>=3.2.0 <3.2.3Red HatRed Hat OpenShift Service MeshRed Hat OpenShift Service Mesh 3.2amd64registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:915c426f6d9e02f951d13df06a3e2398a9cc0cdaae6f4deb71aaaf280ad55421_amd64

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 08/14/2026, 19:29:25 UTC

Technical Analysis

Red Hat OpenShift Service Mesh 3.2.3, based on Istio 1.27.8, fixes multiple security issues including CVE-2025-61726, a memory exhaustion vulnerability in the Go net/url package used for parsing query parameters. This flaw allows an attacker to send HTTP requests with a large number of unique query parameters, causing excessive memory consumption and denial of service. Additional fixes address unexpected TLS session resumption (CVE-2025-68121), code smuggling via doc comments (CVE-2025-61732), arbitrary file writes via malicious pkg-config directives (CVE-2025-61731), excessive CPU consumption during archive index building (CVE-2025-61728), and exposure of hardcoded default keys due to JWKS resolver failure (CVE-2026-31837). The vulnerabilities affect multiple components of the Red Hat OpenShift Service Mesh running on RHEL 9. The update to version 3.2.3 is the official fix.

Potential Impact

The primary impact is denial of service due to memory exhaustion when processing HTTP requests with many unique query parameters, which can cause applications to crash or become unresponsive. Other vulnerabilities could lead to potential code execution vectors, resource exhaustion, or exposure of sensitive cryptographic keys. There is no impact on confidentiality or integrity reported for the denial of service vulnerability. The overall severity is rated as high by Red Hat for the combined issues.

Mitigation Recommendations

Red Hat has released OpenShift Service Mesh version 3.2.3 which includes fixes for all listed vulnerabilities. Users should upgrade to version 3.2.3 as soon as possible. No practical mitigations other than updating are currently identified for the memory exhaustion vulnerability. Follow Red Hat's official documentation and advisories for upgrade instructions.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Gcve Source
db.gcve.eu
Csaf Category
csaf_security_advisory
Csaf Version
2.0
Publisher
Red Hat Product Security
Advisory Id
RHSA-2026:5952
Cve Count
6
Additional Cves
["CVE-2025-61728","CVE-2025-61731","CVE-2025-61732","CVE-2025-68121","CVE-2026-31837"]
State
PUBLISHED

Threat ID: 6a160964e29bf47b50629c1d

Added to database: 05/26/2026, 20:58:12 UTC

Last enriched: 08/14/2026, 19:29:25 UTC

Last updated: 09/10/2026, 19:42:35 UTC

Views: 120

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses