RHSA-2026:9448HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.7

Published
April 21, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2026-34986 →CVE-2026-25679 →CVE-2026-33186 →CVE-2026-33747 →CVE-2026-33748 →

📋 Description

CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33747 — BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend CVE-2026-33748 — github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products26

  • Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:1a1a9cf19de45b8920e70d8123da7f1e7b2568fe356d98203dc0053cee541339_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:46f11470d7627e5a74663770efb3e8118910f5e2f84a1191f6b14805efc10c73_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:883910879ec4940cd9221bd64fbfa392d1ca28503f4e63277169441cb0addeae_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh-tech-preview/istio-ztunnel-rhel9@sha256:8e5be961ce5b17d43e49ad3a0bd5339af75f19d46d11881423c1e86b8bc45a0c_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:0f0dfc2423b897ec2b43dc9fff794690809d845f065c7ae4635191348f4af1d2_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:2040cfbc531f36c1a8387e41911e3e9d26f53a4ef4a24bc712cbe7f33264f356_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:3ba4910ac8b0bed39310344d4cfa21c645922f80cd287b7f66f4b2873871a26a_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:65368e8e6648247d5efe4edb74085384e833d7cac67c93518f3a6efc059fafbd_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:18dc040c6df63b00dbb419895f754d4d728122cf8e245d40cfd9d1f625609bfc_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:4d4ba0754e38ed8824e2a4c1c0e9f603b55650366883339acb67efdbcefae8e0_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:5aee5dd20238fc15d863e2b700f4b510a758d6fcb696b384bcb7aa0854061428_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:629b6b3147b374e2ee5398b4778ef13d7377bc617391df92e0e7b19a4194a6aa_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:702f60c7aa0927bf2b8a4e2077d972222a0fe13b06a6afd5ce6d3e518cae42a5_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:7bc9ffa1c1d9895be132f424d80643bc804a4e99d886762ed16bc8c3d2121c74_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a55d6fe6d7d1d94134e35aa47f3578348b8f0185b7f2c51a69aecb6b8eb2e976_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:e496840d6cf9f281ba71596f477044f370530f37cc5a694d7d538eb37b4f903a_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:321be87a16bb3b4564223709a86bf2d00c831a249de86d48e03855855776d250_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:5d1dda2038649d6dcae41d9ef83d0391cdb7499bb6ebedf8453d197fb06ce055_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7055e7c41cc056bfb96e5b429a78e27e7a7584d97f26eec6601cad5eca403cc9_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:7c918bae6c51890395296e41239ae3101226595d07b880aefd02e765119dbffb_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:149448cd15ef98964551a2527d3287851e3e7726a64e10f94b846a41ed756766_amd64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:2fc0af6b178529161647bc102dd8c762dd850b2598296bf7b045e6b1e31b6606_s390x as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:8f18db5e45ba3934b5878c824cd38ffe989fedad1d28c7d1b39e472f4c0fb43a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:bfd02648a63140c8f810011cbc3f345e0e883a6c3893bb785319fd74871b9ccd_arm64 as a component of Red Hat OpenShift Service Mesh 3.1
  • registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:2f1655b06910cc596ef10f55ad2d34882b82e30b4c6c1a2456bc25cf6e4928c5_amd64 as a component of Red Hat OpenShift Service Mesh 3.1

✅ Remediation

See Red Hat OpenShift Service Mesh 3.1.7 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.

🔗 References (14)