Red Hat OpenShift Service Mesh 3.0.11, based on the open source Istio project, fixes several security vulnerabilities: CVE-2026-27143 involves possible memory corruption after bound check elimination; CVE-2026-27144 involves no-op interface conversion bypassing overlap checking; and CVE-2026-32280 is a Go language denial of service vulnerability in certificate chain building. These vulnerabilities affect multiple components including istio-rhel9-operator, istio-proxyv2-rhel9, istio-pilot-rhel9, and istio-cni-rhel9. The update addresses these issues by providing patched versions of the affected components. The advisory is classified as important by Red Hat and the severity is high. No CVSS scores are provided, and no known exploits have been reported.

The vulnerabilities could lead to memory corruption and denial of service conditions within the affected components of Red Hat OpenShift Service Mesh, potentially impacting the stability and security of microservice communications managed by the service mesh. The issues relate to unsafe memory operations and certificate chain processing, which could be exploited to disrupt service or cause crashes. However, there are no reports of active exploitation in the wild at this time.

Red Hat has released OpenShift Service Mesh version 3.0.11 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. The vendor advisory explicitly provides this update as the solution. There is no indication that additional mitigation steps are required beyond applying the official update.