Red Hat OpenShift Service Mesh 3.1.8, based on the Istio project, fixes several security issues present in earlier versions (>=3.1.0 <3.1.8). The key vulnerabilities include CVE-2026-27143, which is a memory corruption flaw caused by the Go compiler's failure to correctly check for integer overflow or underflow in loop induction variables, allowing invalid memory indexing at runtime. Additional vulnerabilities (CVE-2026-27144 and CVE-2026-32280) involve no-op interface conversion bypassing overlap checking and denial of service in certificate chain building, respectively. These issues affect multiple Istio components packaged for Red Hat Enterprise Linux 9. The vulnerabilities require specific conditions to be exploitable, such as the presence of loops with induction variables used as array indices and the ability to trigger integer overflow or underflow. Red Hat has released OpenShift Service Mesh 3.1.8 with fixes for these vulnerabilities.

Successful exploitation of these vulnerabilities could lead to memory corruption, which may cause application crashes or unexpected behavior, and denial of service conditions in affected components. The memory corruption vulnerability requires an attacker to influence loop induction variables to cause integer overflow or underflow, which is a moderate complexity scenario. The denial of service vulnerability affects certificate chain building in Istio components. No known exploits are reported in the wild at this time.

Red Hat has released OpenShift Service Mesh version 3.1.8 which includes fixes for these vulnerabilities. Users should upgrade to this version to remediate the issues. Additionally, to mitigate CVE-2026-27143, it is recommended to strictly sanitize and enforce bounds checking on any untrusted input that influences loop counters or memory indices to prevent integer overflow or underflow conditions. No other specific mitigations are indicated by the vendor advisory.