RHSA-2026:92451HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.17

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-78669 →CVE-2026-94448 →CVE-2026-111943 →CVE-2026-78667 →CVE-2026-94439 →CVE-2026-94440 →CVE-2026-97030 →CVE-2026-97031 →CVE-2026-97032 →CVE-2026-56857 →CVE-2026-56866 →CVE-2026-78663 →

📋 Description

CVE-2026-56857 — os: golang: golang: Directory traversal via Windows junction handling CVE-2026-56866 — net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections CVE-2026-78663 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-94439 — net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94448 — html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals CVE-2026-97030 — html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97032 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:3faea0dffc8fa17010be9cbdc0b1a25f5f83a854b6814efba9b3658715d12376_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:5827818d3a633a1b2f7fdd735cd6fbd877f6071c8a31b23ddefad66ca4553f81_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:64d0797cf6dc3faaf4e083cdc79ddadccafc45703fcb9196de57d8a6581164c0_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9@sha256:7574675fb515f09abb1a83023a7dc076fc4a09f14c7ad77bccf94b1d9e0234b3_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:376aff60b41a5f02c9e92f19279fecd5081aa13fda82944b0a80dbdfdd904539_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:63a1aaf4e049328edc6262f1618f8f977f4acfe94d3d386b20d75702a5ad418b_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:a8a1ca022ef07f17892f1de4858a3019a07beecb8de87e41c88aa4bcd0bf5124_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ae529fda7909f8de17f836bad9519cb4347e212888fa81016eaa05a0747a7ecf_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:0743046465817d92ecb35606165055641442811446fc2b7e267b7202d19b4522_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:076b84be6150e17352c26dbe262d55667fa10e168f196d67836c04b70a874d3f_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:a5d85b4e7ddacfe41b44ef23964799193563754839a400cfe8da8049bd681383_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f90c1d8bf500ac03229d95de01ab3cf4ca0778e8a9a58010df15ce5884cf4cd8_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:65b3f40e6d119d81191c92c10bb799402c05370adb48c3288d7b8ccea552a3d7_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:8497ef57dc4a50f9cd5e00b7fc2c243aea2b3f0c9e5689671f1c1f051828e0ba_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:93afd62f90e558189fc1c8109a5f7c2800124d80818a8505e9c772aa3e474e2f_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e3a3ff705b906a42b14113b6eb862d8288207bc0864c52a5c08010d311629fb1_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:4705b888e683c0a4f7f74ccec116cd90abddcf97d0c879e51ac3f73897ed1dd0_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:855446c50c8f7009cb6f04aeab8e71fb80781461951ba4c46b2ccd1f2876222f_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:ba3d863b90f7d6230eaec2df36b69c2b21aad61a7fae8c9bb0a78a6bb6d77956_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:dc620e9f06cc54cb92725cecf057ef3d2dc6690e793f702af5b3409466d94eaa_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:139926e73d86056e948c5006cfe87c5c9bd8a0d37ab7bd92552f5056ed700a57_arm64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:671158d717835684081e9d0c2b5c0a1224eac18b99db7b25c2e06a807443806e_amd64 as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:9dc01db9a3b98c855e067b689510ad7f1393e85515e1b09889b711d45b174b42_ppc64le as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:b7d098f887d1913feef49ff9fccc96d997d2431ddd8f795f27a35b3efbc77361_s390x as a component of Red Hat OpenShift Service Mesh 3.0
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:02a5fbb721fc54df29dcf07c639b64c42618c2ae55a722c66d75f3bdf1173d8c_amd64 as a component of Red Hat OpenShift Service Mesh 3.0

✅ Remediation

See Red Hat OpenShift Service Mesh 3.0.17 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.0 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)