RHSA-2026:92480HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.14

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-97030 →CVE-2026-97031 →CVE-2026-111943 →CVE-2026-56857 →CVE-2026-56866 →CVE-2026-94439 →CVE-2026-94440 →CVE-2026-94448 →CVE-2026-97032 →CVE-2026-78663 →CVE-2026-78667 →CVE-2026-78669 →

📋 Description

CVE-2026-56857 — os: golang: golang: Directory traversal via Windows junction handling CVE-2026-56866 — net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections CVE-2026-78663 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server CVE-2026-78667 — net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78669 — net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames CVE-2026-94439 — net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses CVE-2026-94440 — net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing CVE-2026-94448 — html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals CVE-2026-97030 — html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword CVE-2026-97031 — crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references CVE-2026-97032 — net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:40078d45d4337ecfe22379b9377b035abb9fd9bcf9377cfcef37a8d26e37cbb7_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:5fdd9742e84d359e3f0a942de1ac3fe4f619e475e4e9137564bfd756d3b2b430_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:94e42dd833b4abe41ea31382611e4f9a44e40a63e823de2991932dc4613f7cdc_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:cfb5eff533697d988ac24b6070a55eb64385acae4479a2cdbf09015f1cc9a8d3_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:04be8bb8dd56521f57a52fd58858056ba798b6b72eaa24f0747bf22932672f4a_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3b43b1d73c8972d03fd65ae49e527334e2e79ef216a2433db212605d907562c2_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:9b277e4199afcc07c509ad81492beb1123e0915701b7c65a0761f0b200fa7b2a_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:f2c9007a8afa9f4965d6f267224a8e88a915fa82df5ac833237893cec9545db7_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:0eaa9cbb0aea5523ac72fcbcc1b74b611af4d063328166ba40444c13293caf43_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:3d0fa00266bbbf46f265ec8c9bbde94e9601381f7bccd635856afa9510e271a4_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:6ac1d26171485b3da41424338a71307ba60a9c9ed3f94a2f49962693da607e6e_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:8f0954b4de26f9475484df7f2efcde2e062ee9156e7b49ba174fe0e1cd7351a3_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:128f80826b1139aea4deb1e111a6660f4ace0fb0bc99b670a69a946eb2795e83_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:3245a4c3117beafc6894eec8492e948cb722afda825659e4df99e5b6da391846_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:43aaa77cab0d351dbd8da6b80b21686934f7bf2b3856f804f33d465118217289_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e36ce2290176e6315b2f767b38916f86ccd8c38768ee58ec4b5f67b123bd0303_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:34972ab56784d54dba8e7d92cd338e909118f72b6377e2c8f860a6e97f4e0726_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:4bfaa1c51cd6b9b37310972fa7629f6ffb37e61cb660acd5b072c08b640dbfb3_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:97c6fc7322d44dd12ef209714872580fcd5eef408f5d181da7bf6234de83c6ea_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:a21d2521cf1e5b52974b5b9fc649bbe73a103006800fbb618107636f04345ca2_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:43cc8a0838b0ce9be266e05ddbe1285c0e905ccdead9f70a78b657ccac3787f1_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:59633dd2f48335330031876d962eb58747e6ce7258e56fe8782ba58e0807f191_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:750e0a6c9d13c918b0d8e8fec344a538f2fc26de28da73302018ff843e49ccd9_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:c993f0e032e3bf9fdab4a216fb0c75ad11e4f2f03bba6dd0790e81e9fc81597b_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:8d36e210da3f00af65aa2de7e24686a8e82d5f1f2651fca6616aee149ada9886_amd64 as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Red Hat OpenShift Service Mesh 3.1.14 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: In case you consume HTTP2, upgrade to a patched version of the http module. Verify: ``` go version go list -m golang.org/x/net govulncheck ./... ``` Workaround: Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients. For applications managed by systemd, configure the environment variable by creating a service override: systemctl edit <service-name> Add the following lines under the [Service] section: [Service] Environment="GODEBUG=http2server=0" Apply the changes and restart the daemon: systemctl daemon-reload systemctl restart <service-name> To limit network exposure using firewalld, restrict access to trusted networks: firewall-cmd --zone=trusted --add-source=<trusted-ip-range> --permanent firewall-cmd --reload Caveats: Disabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC. Warning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (16)