RHSA-2026:11688 - Security Advisory

Topic

Red Hat OpenShift Service Mesh 2.6.15

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 2.6.15, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

• istio-operator-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• istio-cni-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• pilot-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• ratelimit-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
• istio-cni-rhel8: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
• pilot-rhel8: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
• istio-rhel8-operator: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
• istio-cni-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
• pilot-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
• ratelimit-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
• istio-rhel8-operator: possible memory corruption after bound check elimination (CVE-2026-27143)
• istio-cni-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)
• pilot-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)
• ratelimit-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)
• istio-rhel8-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144)
• istio-cni-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)
• pilot-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)
• ratelimit-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

Solution

See Red Hat OpenShift Service Mesh 2.6.15 documentation at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/service_mesh/service-mesh-2-x

Fixes

CVEs

• CVE-2026-25679
• CVE-2026-27143
• CVE-2026-27144
• CVE-2026-32280
• CVE-2026-34986
• CVE-2026-25679
• CVE-2026-27143
• CVE-2026-27144
• CVE-2026-32280
• CVE-2026-34986

References

• https://access.redhat.com/security/updates/classification
• https://access.redhat.com/security/updates/classification/