RHSA-2026:65115HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.7

Published
September 8, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (18)

CVE-2026-73549 →CVE-2026-39825 →CVE-2026-56858 →CVE-2026-56860 →CVE-2026-73552 →CVE-2026-73513 →CVE-2026-73547 →CVE-2026-73548 →CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56862 →CVE-2026-73511 →CVE-2026-73553 →CVE-2026-50572 →CVE-2026-73546 →CVE-2026-73550 →CVE-2026-73551 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39825 — net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls CVE-2026-50572 — envoy: envoy: ext_authz use-after-free after rejecting an HTTP request CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-73511 — envoy: envoy: path matching bypass via per-segment parameters not stripped by router CVE-2026-73513 — envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free CVE-2026-73546 — envoy: envoy: stored XSS through dynamically generated stat names in admin interface CVE-2026-73547 — envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header CVE-2026-73548 — envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests CVE-2026-73549 — envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters CVE-2026-73550 — envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits CVE-2026-73551 — envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters CVE-2026-73552 — envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values CVE-2026-73553 — envoy: envoy: RBAC authorization bypass when path-parameter stripping is enabled

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:06d2290678383535a72adf45124b4ff4cd112e7488af5ff2b7ade0274e61958e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:79ab7b6bcfcd078bc1d4b432b66c4556b9713d0185d1451c290e5fec0fc19147_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:a464c1950dbb8fd6671cd7c9a931da21d53ee2b4f0da2080811f480747d9c165_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e3a308f371571e57ce3e1d06a9b82c8a5e6ea7a6a011ee9ab13c2a5a593ca2f3_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:7734ec145a1e150f724011f6ecdac20aedd59526add43e54826caf34671e439b_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:7ab3ebf0fdc1f2cd4eb1811d5f0d3d72551feb6b32bdc8129477d7f3bcd44dea_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:c91a30de947e1e8940733903af6bf278fdab15c4d46d7059fa7fe9b1c4f847fc_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:e89b769b9346ef32020497a817d7a6ee2f11d9c9e19a01e45bf59ee5bc39b74e_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:16eed6d7deb07c19d61d95047c7add6470c09294235a230c5dbd18984858986c_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:5adbe715c519ac65ef4f930b3ada2326e534684bedc495fd66edc861e113e6eb_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6b3c9e21a907eec910e44f397781e4992e290ec4370428d8a85d829245667ef2_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:78b8134d45567565eb0eb365042b3c43414fed25e8d1b4b40d3029e864d9f72b_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:2231054be7e3cf53578c362ec677e2fecabf96e8516696b4e79710d5b6f875ac_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5dd85b7b1238aef2ba8da10843bf368234b90e5b7df1b5d8025c4ba40464f14f_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:783b72559574075f713eaceea3bc428d7ec3274a2f9a475d7033d4b92f4575ba_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:c0b7d9fea706615ba973eb44c7c44eec4859d5037696e1b1c880fa4022f430d3_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2a900ea36f46630f379d62ba6844b20f261f2ac259d663ccadc3cc4594b49653_arm64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:4d2c5e711320b986bddfa52c72d292430fee0196a88fdc4af0f10a9cdcb03970_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:74e7228e6a477391e0223a3946d94483309e57eb4d4696b03ffa7342a9e3d2f4_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:769d18355f8955e68b6f91f282c63074b7253dfdc7a8937c4854318143df4fac_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:40ee95b790be644721ed77d2179ebf0cf539bce06a6f89d1f815be796f6c5133_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:6ae671c569cd553f9f48c8c3bf8d00a16db97178d0748f44ef3b6fb74c750038_s390x as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:adc34cb413d31fa5d8a4bd6c560588079c3c271ad9de961da5aced5f6954ec70_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:bf50a2807786e8be677017637355ce0db54d8aa60eb096543bfa4f787c4a4e1a_amd64 as a component of Red Hat OpenShift Service Mesh 3.3
  • registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:facaa199b4e2d33ddeef587b67227580e09a1725546608bc7e01b64d319995c4_arm64 as a component of Red Hat OpenShift Service Mesh 3.3

✅ Remediation

See Red Hat OpenShift Service Mesh 3.3.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Increase the maximum number of query parameters allowed by setting the GODEBUG environment variable `urlmaxqueryparams` to a higher value (e.g., `GODEBUG=urlmaxqueryparams=20000`), or validate and enforce security controls on query parameters at the backend service rather than relying solely on the ReverseProxy's Rewrite or Director function for security filtering. Workaround: Ensure upstream HTTP/2 clusters rely on the default nghttp2 codec rather than enabling the optional oghttp2 codec. Where possible, restrict proxy routing configurations to communicate exclusively with trusted internal backend services. Modifying upstream cluster configurations or rolling out configuration changes requires restarting or reloading affected proxy pods or services, which can cause brief connection interruptions. Workaround: To mitigate exposure without patching, apply the following operational and configuration controls: 1. Restrict administrative interface reachability: Isolate the Envoy administrative interface (typically listening on port 15000 in OpenShift Service Mesh deployments). Ensure it is accessible only via localhost or strictly controlled internal networks by applying OpenShift NetworkPolicies or firewall rules. 2. Avoid interactive browser access to HTML stats: Do not render `/stats?format=html` in an interactive web browser. Use automated metric collectors or command-line tools to query text or JSON representations instead (e.g., `curl http://localhost:15000/stats` or `curl http://localhost:15000/stats?format=json`). 3. Reconfigure dynamic metric filters: Avoid configurations and extensions that generate dynamic statistic names based on untrusted incoming traffic, such as disabling `stats_for_all_methods` in gRPC stats filters. Caveats: Restricting the admin port may disrupt external monitoring tools or custom diagnostic automation that query the management interface. Reconfiguring Envoy proxy settings requires restarting or reloading proxy instances, which may briefly interrupt active network sessions. Workaround: To mitigate this issue: 1. Remove generic, non-WebSocket HTTP upgrade configurations from routes or listeners if custom protocol upgrades are not required. 2. If generic HTTP upgrades are necessary, prevent upstream connection reuse by configuring `max_requests_per_connection: 1` on the affected upstream cluster. In OpenShift Service Mesh, configure an Istio DestinationRule for the target service: ```yaml apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: disable-connection-reuse spec: host: <target-service> trafficPolicy: connectionPool: http: maxRequestsPerConnection: 1 ``` For standalone Envoy instances, define the setting under the upstream cluster configuration: ```yaml clusters: - name: <upstream-cluster> max_requests_per_connection: 1 ``` Caveats: Setting maximum requests per connection to 1 terminates connections after a single transaction, which can increase latency and CPU utilization on proxies and backends due to repeated connection handshakes. Warning: Modifying proxy configurations will initiate a configuration reload and may require restarting proxy pods to flush and terminate existing upstream connection pools. Workaround: Modify Envoy RBAC configurations or OpenShift Service Mesh authorization policies to avoid negative matching logic that relies on regular expressions for HTTP headers. Instead, configure policies using positive allowlists or employ non-regex matchers, such as exact, prefix, suffix, or contains matching rules, which evaluate header values reliably. Caveats: Altering existing access control policies can modify request authorization decisions. Thoroughly test modified policy definitions in a staging environment prior to applying them in production.

🔗 References (21)