RHSA-2026:65115 - Security Advisory

Topic

Red Hat OpenShift Service Mesh 3.3.7

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 3.3.7, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

• CVE-2026-39825 openshift-service-mesh/istio-proxyv2-rhel9: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (OSSM-15833)
• CVE-2026-39825 openshift-service-mesh/istio-pilot-rhel9: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (OSSM-15833)
• CVE-2026-39825 openshift-service-mesh/istio-cni-rhel9: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (OSSM-15833)
• CVE-2026-39825 openshift-service-mesh/istio-rhel9-operator: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (OSSM-15833)
• CVE-2026-56859 openshift-service-mesh/istio-proxyv2-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15413)
• CVE-2026-56859 openshift-service-mesh/istio-pilot-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15413)
• CVE-2026-56859 openshift-service-mesh/istio-cni-rhel9: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15413)
• CVE-2026-56859 openshift-service-mesh/istio-rhel9-operator: Go: Denial of Service via XML decoding recursion depth issue (OSSM-15413)
• CVE-2026-56853 openshift-service-mesh/istio-proxyv2-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15425)
• CVE-2026-56853 openshift-service-mesh/istio-pilot-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15425)
• CVE-2026-56853 openshift-service-mesh/istio-cni-rhel9: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15425)
• CVE-2026-56853 openshift-service-mesh/istio-rhel9-operator: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (OSSM-15425)
• CVE-2026-56858 openshift-service-mesh/istio-proxyv2-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15439)
• CVE-2026-56858 openshift-service-mesh/istio-pilot-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15439)
• CVE-2026-56858 openshift-service-mesh/istio-cni-rhel9: Go html/template: Cross-Site Scripting via pathological input (OSSM-15439)
• CVE-2026-56858 openshift-service-mesh/istio-rhel9-operator: Go html/template: Cross-Site Scripting via pathological input (OSSM-15439)
• CVE-2026-56862 openshift-service-mesh/istio-proxyv2-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15449)
• CVE-2026-56862 openshift-service-mesh/istio-pilot-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15449)
• CVE-2026-56862 openshift-service-mesh/istio-cni-rhel9: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15449)
• CVE-2026-56862 openshift-service-mesh/istio-rhel9-operator: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (OSSM-15449)
• CVE-2026-33818 openshift-service-mesh/istio-proxyv2-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15459)
• CVE-2026-33818 openshift-service-mesh/istio-pilot-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15459)
• CVE-2026-33818 openshift-service-mesh/istio-cni-rhel9: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15459)
• CVE-2026-33818 openshift-service-mesh/istio-rhel9-operator: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (OSSM-15459)
• CVE-2026-56860 openshift-service-mesh/istio-proxyv2-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15464)
• CVE-2026-56860 openshift-service-mesh/istio-pilot-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15464)
• CVE-2026-56860 openshift-service-mesh/istio-cni-rhel9: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15464)
• CVE-2026-56860 openshift-service-mesh/istio-rhel9-operator: golang net/url: Denial of Service from quadratic complexity in path resolution (OSSM-15464)
• CVE-2026-73513 openshift-service-mesh/istio-proxyv2-rhel9: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free (OSSM-15645)
• CVE-2026-73552 openshift-service-mesh/istio-proxyv2-rhel9: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values (OSSM-15650)
• CVE-2026-73547 openshift-service-mesh/istio-proxyv2-rhel9: envoy: ext_authz crash on CONNECT requests without :path pseudo-header (OSSM-15660)
• CVE-2026-73549 openshift-service-mesh/istio-proxyv2-rhel9: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters (OSSM-15665)
• CVE-2026-50572 openshift-service-mesh/istio-proxyv2-rhel9: envoy: ext_authz use-after-free after rejecting an HTTP request (OSSM-15670)
• CVE-2026-73546 openshift-service-mesh/istio-proxyv2-rhel9: envoy: stored XSS through dynamically generated stat names in admin interface (OSSM-15675)
• CVE-2026-73551 openshift-service-mesh/istio-proxyv2-rhel9: envoy: path normalization bypass via dot/dot-dot segments with parameters (OSSM-15685)
• CVE-2026-73511 openshift-service-mesh/istio-proxyv2-rhel9: envoy: path matching bypass via per-segment parameters not stripped by router (OSSM-15690)
• CVE-2026-73548 openshift-service-mesh/istio-proxyv2-rhel9: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests (OSSM-15695)
• CVE-2026-73550 openshift-service-mesh/istio-proxyv2-rhel9: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits (OSSM-15700)
• CVE-2026-73553 openshift-service-mesh/istio-proxyv2-rhel9: envoy: RBAC authorization bypass when path-parameter stripping is enabled (OSSM-15705)
• GHSA-qm8v-g4f9-qhjx openshift-service-mesh/istio-pilot-rhel9: BackendTLSPolicy fails open to plaintext on sidecars when its CA reference is unresolved

Fixes/Improvements:

• Leaking X509 object in SSL_get0_peer_certificates() (OSSM-15075)
• OpenSSL is using glibc allocator instead of tcmalloc (OSSM-15244)
• Sail Operator ClusterRoles (istiod/istio-reader) missing aggregate-to-admin/edit labels — GitOps/namespace-admin users can't manage Istio CRs (e.g. Telemetry) (OSSM-15257)
• Treat CRYPTO_set_mem_functions() failure as non-fatal (OSSM-15621)

Solution

See Red Hat OpenShift Service Mesh 3.3.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3

Affected Products

• Red Hat OpenShift Service Mesh

Fixes

• OSSM-15075 - Leaking X509 object in SSL_get0_peer_certificates()
• OSSM-15244 - OpenSSL is using glibc allocator instead of tcmalloc
• OSSM-15257 - Sail Operator ClusterRoles (istiod/istio-reader) missing aggregate-to-admin/edit labels — GitOps/namespace-admin users can't manage Istio CRs (e.g. Telemetry)
• OSSM-15621 - Treat CRYPTO_set_mem_functions() failure as non-fatal

CVEs

• CVE-2026-33818
• CVE-2026-39825
• CVE-2026-50572
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862
• CVE-2026-73511
• CVE-2026-73513
• CVE-2026-73546
• CVE-2026-73547
• CVE-2026-73548
• CVE-2026-73549
• CVE-2026-73550
• CVE-2026-73551
• CVE-2026-73552
• CVE-2026-73553

References

• https://access.redhat.com/security/updates/classification/