Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3
Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * Updated to Istio version 1.27.8 * Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585) Security Fix(es): * istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837) * istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)
AI Analysis
Technical Summary
Red Hat OpenShift Service Mesh 3.2.3, based on Istio 1.27.8, fixes multiple security issues including CVE-2025-61726, a memory exhaustion vulnerability in the Go net/url package used for parsing query parameters. This flaw allows an attacker to send HTTP requests with a large number of unique query parameters, causing excessive memory consumption and denial of service. Additional fixes address unexpected TLS session resumption (CVE-2025-68121), code smuggling via doc comments (CVE-2025-61732), arbitrary file writes via malicious pkg-config directives (CVE-2025-61731), excessive CPU consumption during archive index building (CVE-2025-61728), and exposure of hardcoded default keys due to JWKS resolver failure (CVE-2026-31837). The vulnerabilities affect multiple components of the Red Hat OpenShift Service Mesh running on RHEL 9. The update to version 3.2.3 is the official fix.
Potential Impact
The primary impact is denial of service due to memory exhaustion when processing HTTP requests with many unique query parameters, which can cause applications to crash or become unresponsive. Other vulnerabilities could lead to potential code execution vectors, resource exhaustion, or exposure of sensitive cryptographic keys. There is no impact on confidentiality or integrity reported for the denial of service vulnerability. The overall severity is rated as high by Red Hat for the combined issues.
Mitigation Recommendations
Red Hat has released OpenShift Service Mesh version 3.2.3 which includes fixes for all listed vulnerabilities. Users should upgrade to version 3.2.3 as soon as possible. No practical mitigations other than updating are currently identified for the memory exhaustion vulnerability. Follow Red Hat's official documentation and advisories for upgrade instructions.
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3
Description
Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * Updated to Istio version 1.27.8 * Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585) Security Fix(es): * istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121) * istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732) * istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728) * istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837) * istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat OpenShift Service Mesh 3.2.3, based on Istio 1.27.8, fixes multiple security issues including CVE-2025-61726, a memory exhaustion vulnerability in the Go net/url package used for parsing query parameters. This flaw allows an attacker to send HTTP requests with a large number of unique query parameters, causing excessive memory consumption and denial of service. Additional fixes address unexpected TLS session resumption (CVE-2025-68121), code smuggling via doc comments (CVE-2025-61732), arbitrary file writes via malicious pkg-config directives (CVE-2025-61731), excessive CPU consumption during archive index building (CVE-2025-61728), and exposure of hardcoded default keys due to JWKS resolver failure (CVE-2026-31837). The vulnerabilities affect multiple components of the Red Hat OpenShift Service Mesh running on RHEL 9. The update to version 3.2.3 is the official fix.
Potential Impact
The primary impact is denial of service due to memory exhaustion when processing HTTP requests with many unique query parameters, which can cause applications to crash or become unresponsive. Other vulnerabilities could lead to potential code execution vectors, resource exhaustion, or exposure of sensitive cryptographic keys. There is no impact on confidentiality or integrity reported for the denial of service vulnerability. The overall severity is rated as high by Red Hat for the combined issues.
Mitigation Recommendations
Red Hat has released OpenShift Service Mesh version 3.2.3 which includes fixes for all listed vulnerabilities. Users should upgrade to version 3.2.3 as soon as possible. No practical mitigations other than updating are currently identified for the memory exhaustion vulnerability. Follow Red Hat's official documentation and advisories for upgrade instructions.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:5952
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-61728","CVE-2025-61731","CVE-2025-61732","CVE-2025-68121","CVE-2026-31837"]
- State
- PUBLISHED
Threat ID: 6a160964e29bf47b50629c1d
Added to database: 05/26/2026, 20:58:12 UTC
Last enriched: 08/14/2026, 19:29:25 UTC
Last updated: 09/10/2026, 19:42:35 UTC
Views: 120
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.