Red Hat OpenShift Service Mesh 3.0.11, based on Istio, fixes multiple security issues including CVE-2026-27143, a flaw in the Go compiler's cmd/compile package. The compiler fails to properly check for integer overflow or underflow in arithmetic operations involving loop induction variables, allowing invalid memory indexing at runtime and possible memory corruption. This affects several Istio components (istio-rhel9-operator, istio-proxyv2-rhel9, istio-pilot-rhel9, istio-cni-rhel9). Exploitation requires a loop with an induction variable used as an array or slice index and the ability to cause integer overflow or underflow. Additional vulnerabilities fixed include no-op interface conversion bypasses and denial of service in certificate chain building. The update is provided as Red Hat OpenShift Service Mesh 3.0.11.

The primary impact is potential memory corruption in affected Istio components due to compiler optimization flaws, which can lead to application instability or crashes. The vulnerability requires specific code patterns and attacker control over loop induction variables to exploit. Red Hat rates the impact as important/high severity with a CVSS base score of 8.1 (Red Hat) and notes that confidentiality, integrity, and availability impacts are high if exploited. No known exploits in the wild have been reported.

A fix is available in Red Hat OpenShift Service Mesh 3.0.11. Users should upgrade to this version to remediate the vulnerabilities. Additionally, to mitigate CVE-2026-27143, it is recommended to strictly sanitize and enforce bounds checking on any untrusted input influencing loop counters or memory indices to prevent integer overflow or underflow. Red Hat provides official documentation and advisories for applying the update.