- Issued:
- 2026-08-03
- Updated:
- 2026-08-03
RHSA-2026:49729 - Security Advisory
Synopsis
Red Hat OpenShift Service Mesh 3.1.11
Type/Severity
Security Advisory: Important
Topic
Red Hat OpenShift Service Mesh 3.1.11
This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
Red Hat OpenShift Service Mesh 3.1.11, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.
Security Fix(es):
- CVE-2026-27145 openshift-service-mesh/istio-proxyv2-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14635)
- CVE-2026-27145 openshift-service-mesh/istio-pilot-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14635)
- CVE-2026-27145 openshift-service-mesh/istio-cni-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14635)
- CVE-2026-27145 openshift-service-mesh/istio-rhel9-operator: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14635)
- CVE-2026-48706 openshift-service-mesh/istio-proxyv2-rhel9: Envoy Heap Buffer Overflow in TcpStatsdSink (OSSM-14831)
- CVE-2026-47204 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via Connect protocol request (OSSM-14838)
- CVE-2026-48042 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via deeply nested JSON objects (OSSM-14843)
- CVE-2026-48044 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Denial of Service via specially crafted zstd payload (OSSM-14849)
- CVE-2026-47221 openshift-service-mesh/istio-proxyv2-rhel9: Envoy: Null pointer deref in internal redirects (OSSM-14854)
Solution
See Red Hat OpenShift Service Mesh 3.1.11 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1
Affected Products
- Red Hat OpenShift Service Mesh
Fixes
(none)amd64
| registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f9b3bf5727289419610d6c3dbfb019a914f7b1d680822ee05725f4225b2cfdac |
| registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:668e8e14e773882aa4e896face7de0a3893e61fcbeda0d94392397e7d83822dc |
| registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:157962811e87e4b0bf8af48bb4bccb785c124866b93ca6bc1339ff5c78352b99 |
| registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:940320a6a77fb2905b08f89ec3746abc1703c093e000c8ac85dab924448d065b |
| registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:c1f56cd35e045f83e9587837ac0dcbe953cfeaccd0876d17b8cb3b54aa0d1dd1 |
| registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:94921265f210e84d79eeba8821c4527e81c36bfc7ce98f0cc8d64b44cbeef7a0 |
| registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:44492274183650ac57f13c65284269f5852c0e21b0d1e8e2d4d465fb3812d64d |
arm64
| registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0fc899d7a731fad940179d669451455eefdbe2b6a94969af7f6a42db761114f9 |
| registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:6d9656677bc51b62ae4266e33d3597873a29d5408fd062ad6374ad6d4523e9b6 |
| registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:e2d4311058f8e49525fc611f0972463542bd2b12bb3a7118d6ae2ca8ccc27ae9 |
| registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:508fa203f347a89f10da5d9321dcbe6b7108da54fd75577f5fc3c42b2b47e341 |
| registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:aac19045406a2c70e71543728fd4f31df14ad9cd6836ffacbeb3218ad3d96e0c |
| registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:7af77e67f9a4c81c8627fb8f21a1cfcc4a36b1b30da189ef244f84520d16b1b8 |
ppc64le
| registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e57b13920b3c526310b4eda0ce05ba79436190273608d37f31bc65dad2532f21 |
| registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5d8647ae7f86875c2100a5f9b422f4378b2c4a207ea676e8ef1fb30458792d65 |
| registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:df8b65603948247391e9142589254608e376749be45ffcf99b2af34745263b6a |
| registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:eb030eaf3626ca662d7d03e0ecd30effcf713cb68d1ee1dea3222bf745e40323 |
| registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:b4e81569b945540d729d2d35519eff01bbc865afdbe2343a692dedabca14f84f |
| registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:e23e614b8207b039a3b5780b27b9aa7a433a0423a602381ca5923a2ac2e798c9 |
s390x
| registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f9cc2daac79e68462ca7426ad485586823c1035e18422b0861fdb19520610a7b |
| registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:a80914528f63045b7a13b86ad0baa0a27ede93ad28dd395709fb0d8c459deb0b |
| registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:229de9a08d9f98c65a28f9cb8523712f55b107350cb85bda55baabad8f754dbb |
| registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:32ca9ff0afb7188c605bc5e1d8b0aea718f11dabb47fec1a65e646a3a683abba |
| registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:d287bfac8a2858a046ef4f19dad906e158292843d445b94da70513112098e327 |
| registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:59456cf33807186ca41a881644e72da5f906f7b7c686cb84e94316e5de06b3cf |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
