Search: CVE-2026-27145

Red Hat OpenShift Service Mesh 3.3.6, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fix(es): * CVE-2026-27145 openshift-service-mesh/istio-proxyv2-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14633) * CVE-2026-27145 openshift-service-mesh/istio-pilot-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14633) * CVE-2026-27145 openshift-service-mesh/istio-cni-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14633) * CVE-2026-27145 openshift-service-mesh/istio-rhel9-operator: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14633) * CVE-2026-48743 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Request desynchronization allows security policy bypass via HTTP/3 to HTTP/1 translation (OSSM-14882) * CVE-2026-47204 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via Connect protocol request (OSSM-14883) * CVE-2026-47221 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Null pointer deref in internal redirects (OSSM-14884) * CVE-2026-48042 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via deeply nested JSON objects (OSSM-14885) * CVE-2026-48044 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via specially crafted zstd payload (OSSM-14886) * CVE-2026-48706 openshift-service-mesh/istio-proxyv2-rhel9: Envoy Heap Buffer Overflow in TcpStatsdSink (OSSM-14887) Fixes/Improvements: * Istiod-default-validator points to non-existent istiod Service after OSSM 3.3.4 upgrade when using non-default Istio name with default revision tag (OSSM-14646)