Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3
Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * Updated to Istio version 1.27.8 * Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585) Security Fix(es): * istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837) * istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)
AI Analysis
Technical Summary
This advisory covers multiple security vulnerabilities fixed in Red Hat OpenShift Service Mesh 3.2.3, which updates Istio to version 1.27.8. The vulnerabilities include: CVE-2025-68121 (unexpected session resumption in crypto/tls), CVE-2025-61732 (potential code smuggling via doc comments in cmd/cgo), CVE-2025-61731 (arbitrary file write via malicious pkg-config directives in cmd/go), CVE-2025-61728 (excessive CPU consumption when building archive index in archive/zip), CVE-2025-61726 (memory exhaustion in query parameter parsing in net/url), and CVE-2026-31837 (JWKS resolver failure exposing hardcoded default keys). These affect multiple components of the service mesh including operator, CNI, pilot, and proxy. The update addresses these issues to improve security and stability of the microservice control plane.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions through excessive CPU or memory consumption, execute arbitrary file writes, potentially smuggle code via documentation comments, cause unexpected session resumption in TLS communications, and expose hardcoded cryptographic keys. These impacts affect the confidentiality, integrity, and availability of the affected components within the Red Hat OpenShift Service Mesh environment. No known exploits in the wild have been reported, but the issues pose significant risks if left unpatched.
Mitigation Recommendations
Red Hat has released OpenShift Service Mesh version 3.2.3 which includes fixes for all listed vulnerabilities by updating to Istio version 1.27.8. Users should upgrade to this version to remediate the security issues. There are no indications that additional mitigations or workarounds are required beyond applying this official update. Patch status is confirmed by the vendor advisory.
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3
Description
Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * Updated to Istio version 1.27.8 * Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585) Security Fix(es): * istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837) * istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers multiple security vulnerabilities fixed in Red Hat OpenShift Service Mesh 3.2.3, which updates Istio to version 1.27.8. The vulnerabilities include: CVE-2025-68121 (unexpected session resumption in crypto/tls), CVE-2025-61732 (potential code smuggling via doc comments in cmd/cgo), CVE-2025-61731 (arbitrary file write via malicious pkg-config directives in cmd/go), CVE-2025-61728 (excessive CPU consumption when building archive index in archive/zip), CVE-2025-61726 (memory exhaustion in query parameter parsing in net/url), and CVE-2026-31837 (JWKS resolver failure exposing hardcoded default keys). These affect multiple components of the service mesh including operator, CNI, pilot, and proxy. The update addresses these issues to improve security and stability of the microservice control plane.
Potential Impact
The vulnerabilities collectively could allow attackers to cause denial of service conditions through excessive CPU or memory consumption, execute arbitrary file writes, potentially smuggle code via documentation comments, cause unexpected session resumption in TLS communications, and expose hardcoded cryptographic keys. These impacts affect the confidentiality, integrity, and availability of the affected components within the Red Hat OpenShift Service Mesh environment. No known exploits in the wild have been reported, but the issues pose significant risks if left unpatched.
Mitigation Recommendations
Red Hat has released OpenShift Service Mesh version 3.2.3 which includes fixes for all listed vulnerabilities by updating to Istio version 1.27.8. Users should upgrade to this version to remediate the security issues. There are no indications that additional mitigations or workarounds are required beyond applying this official update. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:5952
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-61728","CVE-2025-61731","CVE-2025-61732","CVE-2025-68121","CVE-2026-31837"]
- Cvss Version
- null
Threat ID: 6a160964e29bf47b50629c1d
Added to database: 05/26/2026, 20:58:12 UTC
Last enriched: 07/30/2026, 10:13:39 UTC
Last updated: 07/31/2026, 19:30:09 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.