Threats Tagged 'cve-2026-31837'

Red Hat OpenShift Service Mesh 3. 1. 6 addresses multiple security vulnerabilities affecting components based on the Istio project. These include issues such as unexpected TLS session resumption, potential code smuggling via doc comments, arbitrary file write via malicious pkg-config directives, excessive CPU consumption during archive processing, memory exhaustion in URL query parameter parsing, and exposure of hardcoded default keys due to JWKS resolver failures. The advisory covers six CVEs with a high severity rating. Red Hat has released this update to fix these vulnerabilities and improve the stability of the service mesh. No known exploits in the wild have been reported at this time.

Red Hat OpenShift Service Mesh 3. 2. 3, based on Istio 1. 27. 8, addresses multiple security vulnerabilities affecting components such as istio-rhel9-operator, istio-cni-rhel9, istio-pilot-rhel9, and istio-proxyv2-rhel9. The fixed issues include unexpected session resumption in crypto/tls, potential code smuggling via doc comments, arbitrary file write via malicious pkg-config directives, excessive CPU consumption during archive index building, memory exhaustion in query parameter parsing, and exposure of hardcoded default keys due to JWKS resolver failure. These vulnerabilities collectively pose risks including resource exhaustion, unauthorized file writes, and potential cryptographic weaknesses. Red Hat has released this update as a security advisory (RHSA-2026:5952) to mitigate these issues. No known exploits in the wild have been reported at this time.

Red Hat OpenShift AI version 3. 3. 3 addresses multiple critical security vulnerabilities identified by CVE-2025-6242 and 45 additional CVEs. The advisory announces updated container images for Red Hat OpenShift AI to mitigate these issues. No specific technical details or fixes for individual CVEs are provided in the advisory content. There are no known exploits in the wild at the time of publication. The vendor has released updated images and documentation to guide users on upgrading their clusters to apply the errata update. Patch status is not explicitly confirmed in the advisory, and no direct patch links are provided. Users should consult the official Red Hat documentation for upgrade instructions and remediation details. The vulnerabilities collectively are rated critical in severity.