RHSA-2026:92516 - Security Advisory

Topic

Red Hat OpenShift Service Mesh 3.4.4

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 3.4.4, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

• CVE-2026-111943 golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (OSSM-16395)
• CVE-2026-97031 crypto/tls: Denial of Service via multiple ECH outer extension references (OSSM-16200)
• CVE-2026-94439 net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses (OSSM-16204)
• CVE-2026-56857 golang: Directory traversal via Windows junction handling (OSSM-16213)
• CVE-2026-94448 golang: cross-site scripting via consecutive expressions in JavaScript template literals (OSSM-16217)
• CVE-2026-56866 golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections (OSSM-16223)
• CVE-2026-78667 golang: Denial of Service via crafted HTTP Range headers (OSSM-16229)
• CVE-2026-97032 net/http: Denial of Service via concurrent HPACK encoder modification (OSSM-16233)
• CVE-2026-78663 golang: flow control limit bypass via double refund in HTTP/2 server (OSSM-16239)
• CVE-2026-78669 net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (OSSM-16240, OSSM-16242)
• CVE-2026-97030 html/template: Cross-site scripting via improper escaping of yield keyword (OSSM-16406)
• CVE-2026-94440 golang: Denial of Service via memory limit bypass in multipart form parsing (OSSM-16407, OSSM-16408)

Fixes/Improvements:

• Update ZTunnel to offer ML-KEM by default (OSSM-16246)

Solution

See Red Hat OpenShift Service Mesh 3.4.4 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.4

Affected Products

• Red Hat OpenShift Service Mesh

Fixes

• OSSM-16246 - Update ZTunnel to offer ML-KEM by default

CVEs

• CVE-2026-111943
• CVE-2026-56857
• CVE-2026-56866
• CVE-2026-78663
• CVE-2026-78667
• CVE-2026-78669
• CVE-2026-94439
• CVE-2026-94440
• CVE-2026-94448
• CVE-2026-97030
• CVE-2026-97031
• CVE-2026-97032

References

• https://access.redhat.com/security/updates/classification
• https://access.redhat.com/security/updates/classification/