RHSA-2026:49770 - Security Advisory

Topic

Red Hat OpenShift Service Mesh 3.4.1

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 3.4.1, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

• CVE-2026-27145 openshift-service-mesh/istio-proxyv2-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
• CVE-2026-27145 openshift-service-mesh/istio-pilot-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
• CVE-2026-27145 openshift-service-mesh/istio-cni-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
• CVE-2026-27145 openshift-service-mesh/istio-rhel9-operator: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)

Fixes/Improvements:

• Istiod-default-validator points to non-existent istiod Service after OSSM 3.3.4 upgrade when using non-default Istio name with default revision tag (OSSM-14646)

Solution

See Red Hat OpenShift Service Mesh 3.4.1 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4

Affected Products

• Red Hat OpenShift Service Mesh

Fixes

CVEs

• CVE-2026-27145

References

• https://access.redhat.com/security/updates/classification/