This advisory covers multiple security vulnerabilities in Red Hat OpenShift Service Mesh versions 2.6.0 and 2.6.1. The vulnerabilities affect several underlying libraries and components such as send (CVE-2024-43799), serve-static (CVE-2024-43800), express (CVE-2024-43796), path-to-regexp (CVE-2024-45296), webpack (CVE-2024-43788), body-parser (CVE-2024-45590), envoy (CVE-2024-45806, CVE-2024-45808, CVE-2024-45810), and curl/libcurl (CVE-2024-7264). These issues range from code execution vulnerabilities, improper input sanitization, denial of service, malicious log injection, to potential header manipulation and crashes. Red Hat has released version 2.6.2 of OpenShift Service Mesh to address these vulnerabilities. The advisory references multiple CVEs and provides detailed fixes for each component.

The vulnerabilities collectively pose a high security risk including potential remote code execution, denial of service, and manipulation of HTTP headers and logs. Exploitation could lead to unauthorized code execution, service disruption, or information manipulation within the OpenShift Service Mesh environment. No known exploits in the wild have been reported at this time.

Red Hat has released OpenShift Service Mesh version 2.6.2 which includes fixes for all listed vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official advisory. No additional mitigations are specified beyond applying the official update.