RHSA-2026:92509

Vulnerability from csaf_redhat - Published: 2026-10-29 15:19 - Updated: 2026-10-30 19:04
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.9
Severity
Important
Notes
Topic: Red Hat OpenShift Service Mesh 3.3.9 This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Service Mesh 3.3.9, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fix(es): * CVE-2026-111943 golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (OSSM-16395) * CVE-2026-97031 crypto/tls: Denial of Service via multiple ECH outer extension references (OSSM-16203) * CVE-2026-94439 net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses (OSSM-16206) * CVE-2026-56857 golang: Directory traversal via Windows junction handling (OSSM-16210) * CVE-2026-94448 golang: cross-site scripting via consecutive expressions in JavaScript template literals (OSSM-16215) * CVE-2026-56866 golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections (OSSM-16221) * CVE-2026-78667 golang: Denial of Service via crafted HTTP Range headers (OSSM-16226) * CVE-2026-97032 net/http: Denial of Service via concurrent HPACK encoder modification (OSSM-16234) * CVE-2026-78663 golang: flow control limit bypass via double refund in HTTP/2 server (OSSM-16236) * CVE-2026-78669 net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (OSSM-16241) * CVE-2026-94440 golang: Denial of Service via memory limit bypass in multipart form parsing (OSSM-16397) * CVE-2026-97030 html/template: Cross-site scripting via improper escaping of yield keyword (OSSM-16402)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-56857

A flaw was found in the Go standard library's file system operations on Windows. Scoped directory operations fail to properly restrict directory creation when processing Windows junction points (links redirecting to other folder locations) that point outside the designated root directory. An attacker can exploit this weakness to create directories outside the restricted boundary, bypassing intended directory confinement controls.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64 —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x —
Workaround
Unresolved product id: Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le —
Workaround
Threats
Impact Low
CVE-2026-56866

A flaw was found in Go's net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-78663

A flaw was found in Go's HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits—mechanisms that regulate incoming network data—potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-78667

A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Important
CVE-2026-78669

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Important
CVE-2026-94439

A flaw was found in Go's net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-94448

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user's browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-97030

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user's web browser.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-97031

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Important
CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-366 - Race Condition within a Thread
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Moderate
CVE-2026-111943

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 16 products, the same list as for CVE-2026-56857
Known not affected 9 products, the same list as for CVE-2026-56857
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:92509 self
https://access.redhat.com/security/cve/CVE-2026-111943 external
https://access.redhat.com/security/cve/CVE-2026-56857 external
https://access.redhat.com/security/cve/CVE-2026-56866 external
https://access.redhat.com/security/cve/CVE-2026-78663 external
https://access.redhat.com/security/cve/CVE-2026-78667 external
https://access.redhat.com/security/cve/CVE-2026-78669 external
https://access.redhat.com/security/cve/CVE-2026-94439 external
https://access.redhat.com/security/cve/CVE-2026-94440 external
https://access.redhat.com/security/cve/CVE-2026-94448 external
https://access.redhat.com/security/cve/CVE-2026-97030 external
https://access.redhat.com/security/cve/CVE-2026-97031 external
https://access.redhat.com/security/cve/CVE-2026-97032 external
https://access.redhat.com/security/updates/classi… external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-56857 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548348 external
https://www.cve.org/CVERecord?id=CVE-2026-56857 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56857 external
https://go.dev/cl/847305 external
https://go.dev/issue/81739 external
https://groups.google.com/g/golang-announce/c/U2f… external
https://pkg.go.dev/vuln/GO-2026-6604 external
https://access.redhat.com/security/cve/CVE-2026-56866 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548347 external
https://www.cve.org/CVERecord?id=CVE-2026-56866 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56866 external
https://go.dev/cl/847306 external
https://go.dev/issue/81740 external
https://pkg.go.dev/vuln/GO-2026-6605 external
https://access.redhat.com/security/cve/CVE-2026-78663 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548345 external
https://www.cve.org/CVERecord?id=CVE-2026-78663 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78663 external
https://go.dev/cl/847187 external
https://go.dev/cl/847310 external
https://go.dev/issue/81743 external
https://groups.google.com/g/golang-announce/c/ZPw… external
https://pkg.go.dev/vuln/GO-2026-6612 external
https://access.redhat.com/security/cve/CVE-2026-78667 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548334 external
https://www.cve.org/CVERecord?id=CVE-2026-78667 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78667 external
https://go.dev/cl/847309 external
https://go.dev/issue/81858 external
https://pkg.go.dev/vuln/GO-2026-6609 external
https://access.redhat.com/security/cve/CVE-2026-78669 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548344 external
https://www.cve.org/CVERecord?id=CVE-2026-78669 external
https://nvd.nist.gov/vuln/detail/CVE-2026-78669 external
https://go.dev/cl/847186 external
https://go.dev/cl/847308 external
https://go.dev/issue/81742 external
https://pkg.go.dev/vuln/GO-2026-6611 external
https://access.redhat.com/security/cve/CVE-2026-94439 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548335 external
https://www.cve.org/CVERecord?id=CVE-2026-94439 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94439 external
https://go.dev/cl/847311 external
https://go.dev/issue/81744 external
https://pkg.go.dev/vuln/GO-2026-6613 external
https://access.redhat.com/security/cve/CVE-2026-94440 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548341 external
https://www.cve.org/CVERecord?id=CVE-2026-94440 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94440 external
https://go.dev/cl/847307 external
https://go.dev/issue/81741 external
https://pkg.go.dev/vuln/GO-2026-6608 external
https://access.redhat.com/security/cve/CVE-2026-94448 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548346 external
https://www.cve.org/CVERecord?id=CVE-2026-94448 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94448 external
https://go.dev/cl/839866 external
https://go.dev/issue/81821 external
https://pkg.go.dev/vuln/GO-2026-6599 external
https://access.redhat.com/security/cve/CVE-2026-97030 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548338 external
https://www.cve.org/CVERecord?id=CVE-2026-97030 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97030 external
https://go.dev/cl/840925 external
https://go.dev/issue/81823 external
https://pkg.go.dev/vuln/GO-2026-6600 external
https://access.redhat.com/security/cve/CVE-2026-97031 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548336 external
https://www.cve.org/CVERecord?id=CVE-2026-97031 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97031 external
https://go.dev/cl/847312 external
https://go.dev/issue/81855 external
https://pkg.go.dev/vuln/GO-2026-6607 external
https://access.redhat.com/security/cve/CVE-2026-97032 self
https://bugzilla.redhat.com/show_bug.cgi?id=2548337 external
https://www.cve.org/CVERecord?id=CVE-2026-97032 external
https://nvd.nist.gov/vuln/detail/CVE-2026-97032 external
https://go.dev/cl/847188 external
https://go.dev/cl/847313 external
https://go.dev/issue/81867 external
https://pkg.go.dev/vuln/GO-2026-6617 external
https://access.redhat.com/security/cve/CVE-2026-111943 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-111943 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943 external
https://github.com/golang/go/issues/82345 external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU external
https://pkg.go.dev/vuln/GO-2026-6809 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Service Mesh 3.3.9\n\nThis update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Service Mesh 3.3.9, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.\n\nSecurity Fix(es):\n\n* CVE-2026-111943 golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (OSSM-16395)\n* CVE-2026-97031 crypto/tls: Denial of Service via multiple ECH outer extension references (OSSM-16203)\n* CVE-2026-94439 net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses (OSSM-16206)\n* CVE-2026-56857 golang: Directory traversal via Windows junction handling (OSSM-16210)\n* CVE-2026-94448 golang: cross-site scripting via consecutive expressions in JavaScript template literals (OSSM-16215)\n* CVE-2026-56866 golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections (OSSM-16221)\n* CVE-2026-78667 golang: Denial of Service via crafted HTTP Range headers (OSSM-16226)\n* CVE-2026-97032 net/http: Denial of Service via concurrent HPACK encoder modification (OSSM-16234)\n* CVE-2026-78663 golang: flow control limit bypass via double refund in HTTP/2 server (OSSM-16236)\n* CVE-2026-78669 net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (OSSM-16241)\n* CVE-2026-94440 golang: Denial of Service via memory limit bypass in multipart form parsing (OSSM-16397)\n* CVE-2026-97030 html/template: Cross-site scripting via improper escaping of yield keyword (OSSM-16402)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:92509",
        "url": "https://access.redhat.com/errata/RHSA-2026:92509"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-111943",
        "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56857",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56857"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56866",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56866"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78663",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78663"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78667",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-78669",
        "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-94439",
        "url": "https://access.redhat.com/security/cve/CVE-2026-94439"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-94440",
        "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-94448",
        "url": "https://access.redhat.com/security/cve/CVE-2026-94448"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97030",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97030"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97031",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97032",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97032"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification",
        "url": "https://access.redhat.com/security/updates/classification"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92509.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.9",
    "tracking": {
      "current_release_date": "2026-10-30T19:04:59+00:00",
      "generator": {
        "date": "2026-10-30T19:04:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:92509",
      "initial_release_date": "2026-10-29T15:19:54+00:00",
      "revision_history": [
        {
          "date": "2026-10-29T15:19:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-29T15:19:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T19:04:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Service Mesh 3.3",
                "product": {
                  "name": "Red Hat OpenShift Service Mesh 3.3",
                  "product_id": "Red Hat OpenShift Service Mesh 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-sail-operator-bundle@sha256%3Af2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle\u0026tag=1792951431"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-cni-rhel9@sha256%3Ae2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel9\u0026tag=1792912245"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-must-gather-rhel9@sha256%3Ad6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9\u0026tag=1792911524"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-rhel9-operator@sha256%3A12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-rhel9-operator\u0026tag=1792911854"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-pilot-rhel9@sha256%3Aca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9\u0026tag=1792911805"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9\u0026tag=1792944701"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9\u0026tag=1792912719"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-cni-rhel9@sha256%3A00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel9\u0026tag=1792912245"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-must-gather-rhel9@sha256%3Af274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9\u0026tag=1792911524"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-rhel9-operator@sha256%3Adc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-rhel9-operator\u0026tag=1792911854"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-pilot-rhel9@sha256%3A1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9\u0026tag=1792911805"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9\u0026tag=1792944701"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e?arch=arm64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9\u0026tag=1792912719"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-cni-rhel9@sha256%3Aad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel9\u0026tag=1792912245"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-must-gather-rhel9@sha256%3A1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9\u0026tag=1792911524"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-rhel9-operator@sha256%3A3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-rhel9-operator\u0026tag=1792911854"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-pilot-rhel9@sha256%3A6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9\u0026tag=1792911805"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9\u0026tag=1792944701"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3Ace4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9\u0026tag=1792912719"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-cni-rhel9@sha256%3A32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel9\u0026tag=1792912245"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-must-gather-rhel9@sha256%3Adb6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9\u0026tag=1792911524"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-rhel9-operator@sha256%3A633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-rhel9-operator\u0026tag=1792911854"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-pilot-rhel9@sha256%3Aa8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9\u0026tag=1792911805"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-proxyv2-rhel9@sha256%3A20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9\u0026tag=1792944701"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
                "product": {
                  "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
                  "product_id": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/istio-ztunnel-rhel9@sha256%3A97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9\u0026tag=1792912719"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64 as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3",
          "product_id": "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        },
        "product_reference": "registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift Service Mesh 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56857",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:43.797986+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library\u0027s file system operations on Windows. Scoped directory operations fail to properly restrict directory creation when processing Windows junction points (links redirecting to other folder locations) that point outside the designated root directory. An attacker can exploit this weakness to create directories outside the restricted boundary, bypassing intended directory confinement controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "os: golang: golang: Directory traversal via Windows junction handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this flaw as LOW severity. A flaw was found in the Go standard library\u0027s scoped filesystem implementation (os.Root) on Windows. When Root.Mkdir or Root.MkdirAll is called and the final path component of the target is an NTFS junction that points to an empty location outside the designated root directory, the operation follows the junction and creates a directory outside the restricted boundary, bypassing the intended directory confinement. The issue only applies when the last path component is a junction (path/to/junction, but not path/junction/target), and only to Go programs running on Windows. Exploitation requires local filesystem access with standard unprivileged user privileges to plant the junction that a Go application using these scoped operations then targets; no user interaction is required. Successful exploitation allows an attacker to create unauthorized directories outside the root (low integrity impact), with no impact on confidentiality or availability, and without crossing security-authority boundaries. Red Hat products shipping the Go toolchain or Go-based components are recorded as affected, including Red Hat Enterprise Linux, Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, Red Hat OpenStack Platform, Red Hat AMQ, and Red Hat Edge Manager, among other streams. Because the impact is LOW, fixes in affected Red Hat streams are deferred and no update trackers are filed for this severity, while some streams outside full support scope are resolved as out of support scope; the residual risk is limited to Windows deployments of Go applications that rely on os.Root confinement in environments where untrusted local users can create NTFS junctions. Red Hat\u0027s LOW rating (CVSS 3.3, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) differs significantly from the CISA score of 9.8, which does not reflect the local access and privileges required to exploit this issue or its directory-creation-only consequence.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56857"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548348"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56857",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56857"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56857",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56857"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847305",
          "url": "https://go.dev/cl/847305"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81739",
          "url": "https://go.dev/issue/81739"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6604",
          "url": "https://pkg.go.dev/vuln/GO-2026-6604"
        }
      ],
      "release_date": "2026-10-08T22:53:58.387000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "os: golang: golang: Directory traversal via Windows junction handling"
    },
    {
      "cve": "CVE-2026-56866",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:40.419728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548347"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. When an HTTP CONNECT request with a request body is rejected by a server, the client transport can desynchronize the connection before returning it to the shared idle pool. In shared reverse proxy environments, a remote attacker can exploit this issue to cause cross-user response poisoning, potentially exposing sensitive information or serving unintended content to other users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw of moderate impact was found in the Go standard library net/http package, which is shipped by a broad range of Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset components), Red Hat Enterprise Linux AI, OpenShift Container Platform and other Go-based components across Red Hat\u0027s portfolio. When http.Transport sends an HTTP/1 CONNECT request that carries a non-empty request body, the body is written to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the desynchronized connection to the shared idle pool, and the trailing body bytes can be interpreted by the server as a subsequent pipelined request. A remote attacker able to send requests through a reverse proxy (including httputil.ReverseProxy) that forwards CONNECT requests via a shared Transport could exploit this to poison the responses received by other users of the pooled connection, potentially exposing sensitive information or serving unintended content to them. Red Hat rates this flaw MODERATE (CVSS 6.5, limited confidentiality and integrity impact with no availability impact), which is lower than the CISA score of 7.5 (IMPORTANT) based on a confidentiality-only vector; Red Hat\u0027s assessment reflects that the exposure requires a shared reverse-proxy deployment that forwards CONNECT requests with bodies and yields low confidentiality and integrity impact. For most affected Red Hat products the fix is deferred because the flaw is rated MODERATE severity with a CVSS score below 7.0, so the residual risk of cross-user response poisoning in such proxy deployments remains until a fix is delivered; for a subset of affected products fixes are being pursued by their maintaining teams, and some affected streams are out of active support.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548347",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548347"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56866",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56866",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847306",
          "url": "https://go.dev/cl/847306"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81740",
          "url": "https://go.dev/issue/81740"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6605",
          "url": "https://pkg.go.dev/vuln/GO-2026-6605"
        }
      ],
      "release_date": "2026-10-08T22:53:58.586000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections"
    },
    {
      "cve": "CVE-2026-78663",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:32.835933+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s HTTP/2 server implementation. A remote attacker can bypass connection-level flow control limits\u2014mechanisms that regulate incoming network data\u2014potentially causing excessive memory consumption and a Denial of Service (DoS). This issue occurs because the server improperly refunds flow control credits twice for the same data: once when a client resets a stream, and again when the application reads the buffered data. Consequently, a malicious client can exceed configured connection buffer limits.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having a Moderate security impact because, while remote unauthenticated clients can bypass configured connection receive buffer thresholds on affected HTTP/2 servers, overall resource exhaustion remains bounded. Exploitation is constrained by stream-level flow controls and limits on concurrent streams, which prevents an attacker from causing unbounded memory consumption or a complete denial of service. Go-based network services handling untrusted HTTP/2 traffic may experience elevated memory usage under sustained reset attacks, but typical deployments remain operational without catastrophic service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78663",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78663",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78663"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847187",
          "url": "https://go.dev/cl/847187"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847310",
          "url": "https://go.dev/cl/847310"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81743",
          "url": "https://go.dev/issue/81743"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6612",
          "url": "https://pkg.go.dev/vuln/GO-2026-6612"
        }
      ],
      "release_date": "2026-10-08T22:53:59.772000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server"
    },
    {
      "cve": "CVE-2026-78667",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:51.418048+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548334"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with an Important severity for Red Hat products because an unauthenticated remote attacker can exhaust server compute resources over the network, leading to a complete service outage. Across Red Hat enterprise environments, Go is widely deployed in container runtimes, monitoring daemons, and OpenShift infrastructure components. However, exploitation is restricted to applications that actively listen on the network and serve content using standard library HTTP handlers that process multi-range requests. CLI utilities and server components that do not handle byte-range requests from untrusted clients remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548334",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548334"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78667",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847309",
          "url": "https://go.dev/cl/847309"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81858",
          "url": "https://go.dev/issue/81858"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6609",
          "url": "https://pkg.go.dev/vuln/GO-2026-6609"
        }
      ],
      "release_date": "2026-10-08T22:53:59.148000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers"
    },
    {
      "cve": "CVE-2026-78669",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:28.964317+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548344"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service (DoS) by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration (SETTINGS) frames that modify window sizes, an attacker forces the system into intensive state processing. This resource exhaustion degrades performance and can render the service unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Go net/http package and the golang.org/x/net/http2 module. A malicious HTTP/2 peer can cause excessive CPU consumption by opening a large number of HTTP/2 streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. Each SETTINGS frame forces the server or client to iterate over all open streams to adjust their flow-control windows, resulting in quadratic CPU usage and denial of service.\n\nThis vulnerability affects all Go programs that serve or consume HTTP/2 traffic using net/http or golang.org/x/net/http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548344",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548344"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78669",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78669"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847186",
          "url": "https://go.dev/cl/847186"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847308",
          "url": "https://go.dev/cl/847308"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81742",
          "url": "https://go.dev/issue/81742"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6611",
          "url": "https://pkg.go.dev/vuln/GO-2026-6611"
        }
      ],
      "release_date": "2026-10-08T22:53:59.530000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "In case you consume HTTP2, upgrade to a patched version of the http module.\n\nVerify:\n```\ngo version\ngo list -m golang.org/x/net\ngovulncheck ./...\n```",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames"
    },
    {
      "cve": "CVE-2026-94439",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-08T23:00:55.470995+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. When an HTTP server sends a successful response to an HTTP/1 CONNECT request without taking raw control of the connection, it improperly continues to process incoming data as standard HTTP requests instead of establishing a tunnel. A remote attacker can exploit this behavior to conduct HTTP request smuggling through intermediate proxy servers, potentially bypassing security controls.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate-impact flaw was found in the Go standard library net/http package, which is shipped in the golang and go-toolset components of Red Hat Enterprise Linux and used by many Go-based Red Hat products and components (including Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and bundled components such as osbuild-composer and rhc). When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve HTTP requests from a connection that should be treated as an opaque tunnel. A remote, unauthenticated attacker who can reach the server through an intermediate proxy that treats the connection as tunneled can exploit this desynchronization to conduct HTTP request smuggling, potentially bypassing proxy-enforced security controls and accessing requests or responses intended for other users. Red Hat rates this flaw Moderate severity (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting the limited confidentiality and integrity impact. Because the impact is Moderate with a CVSS score below 7.0, fixes for the affected Red Hat products are currently deferred rather than scheduled for an immediate update, and the Red Hat In-Vehicle OS 2.0.z streams are out of support scope. The residual risk of deferral is limited to HTTP request smuggling against servers that accept HTTP/1 CONNECT requests and are deployed behind an intermediate proxy.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94439",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847311",
          "url": "https://go.dev/cl/847311"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81744",
          "url": "https://go.dev/issue/81744"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6613",
          "url": "https://pkg.go.dev/vuln/GO-2026-6613"
        }
      ],
      "release_date": "2026-10-08T22:53:59.976000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses"
    },
    {
      "cve": "CVE-2026-94440",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:01:17.316758+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read an arbitrarily long line into memory, leading to excessive resource consumption and a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate severity for Red Hat products because, while an unauthenticated remote attacker can trigger excessive memory consumption leading to a denial of service, exploitation cannot lead to code execution or information disclosure. The issue specifically threatens Go-based services and daemons that accept and process incoming multipart HTTP form payloads. Applications built with Go that do not expose web interfaces or parse multipart request streams are unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94440",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94440"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847307",
          "url": "https://go.dev/cl/847307"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81741",
          "url": "https://go.dev/issue/81741"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6608",
          "url": "https://pkg.go.dev/vuln/GO-2026-6608"
        }
      ],
      "release_date": "2026-10-08T22:53:58.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing"
    },
    {
      "cve": "CVE-2026-94448",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:36.563246+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548346"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS, an attack that executes malicious scripts in a user\u0027s browser) through improper output escaping. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state. Consequently, subsequent regular expression literals are not accurately recognized and escaped, potentially allowing untrusted content to bypass template sanitization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A MODERATE severity cross-site scripting (XSS) vulnerability was found in Go\u0027s html/template package, which is shipped and used across multiple Red Hat products, including Red Hat Enterprise Linux (golang and go-toolset), Red Hat Enterprise Linux AI, Red Hat In-Vehicle OS, and other components that build against the Go toolchain. When a JavaScript template literal contains consecutive expressions, the parser fails to properly reset its context tracking state upon entering a new expression. As a result, subsequent regular expression literals are not accurately recognized and escaped, allowing a remote attacker to supply untrusted content through a template that bypasses html/template sanitization and executes malicious script in a victim\u0027s browser. Successful exploitation requires a victim user to visit a rendered page of a Go web application that interpolates attacker-controlled input into JavaScript template literals. Red Hat has rated this flaw MODERATE with a CVSS 3.1 score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), consistent with the upstream assessment; the impact is limited to low confidentiality and integrity loss within the client browser context, with no availability impact. Because the CVSS score is below 7.0, the fix is deferred for the affected Red Hat product streams and update trackers are not being filed for this MODERATE severity flaw at this time. The residual risk is limited to Go-based web applications that render attacker-controlled content through html/template into JavaScript contexts; the flaw does not affect applications that do not use html/template with JavaScript template literals.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548346",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548346"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94448",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94448",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94448"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/839866",
          "url": "https://go.dev/cl/839866"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81821",
          "url": "https://go.dev/issue/81821"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6599",
          "url": "https://pkg.go.dev/vuln/GO-2026-6599"
        }
      ],
      "release_date": "2026-10-08T22:53:57.417000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals"
    },
    {
      "cve": "CVE-2026-97030",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-10-08T23:01:06.022541+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s html/template component. This vulnerability allows cross-site scripting (XSS) due to improper escaping of the \u0027yield\u0027 keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary script execution in a user\u0027s web browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires victim interaction through a web browser and is contingent on an application processing untrusted input within templates that employ the \u0027yield\u0027 keyword. In Red Hat environments, Go is predominantly utilized for backend management daemons, container tooling, and command-line utilities rather than serving dynamic web interfaces via this package. Consequently, typical deployments do not expose web-rendered content to untrusted clients, substantially limiting the attack surface across supported products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97030",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97030"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/840925",
          "url": "https://go.dev/cl/840925"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81823",
          "url": "https://go.dev/issue/81823"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6600",
          "url": "https://pkg.go.dev/vuln/GO-2026-6600"
        }
      ],
      "release_date": "2026-10-08T22:53:57.597000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword"
    },
    {
      "cve": "CVE-2026-97031",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T23:00:59.284728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello (ECH) outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a Denial of Service (DoS) through server crashes or unresponsiveness.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can trigger memory exhaustion and crash server processes without requiring privileges or user interaction. Go applications that terminate TLS connections and accept Encrypted Client Hello configurations are vulnerable to resource amplification during the initial handshake. While the flaw does not facilitate arbitrary code execution or compromise data confidentiality, the resulting denial of service can disrupt critical network services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97031",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847312",
          "url": "https://go.dev/cl/847312"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81855",
          "url": "https://go.dev/issue/81855"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6607",
          "url": "https://pkg.go.dev/vuln/GO-2026-6607"
        }
      ],
      "release_date": "2026-10-08T22:53:58.775000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references"
    },
    {
      "cve": "CVE-2026-97032",
      "cwe": {
        "id": "CWE-366",
        "name": "Race Condition within a Thread"
      },
      "discovery_date": "2026-10-08T23:01:02.635561+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548337"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s net/http package. A remote attacker can cause a Denial of Service (DoS) by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK (HTTP/2 header compression) encoder when encoding response headers while processing incoming table size configuration updates. A malicious client can exploit this race condition by repeatedly sending requests while altering the header table size, ultimately causing the server process to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated with a Moderate severity for Red Hat products because, although remotely triggerable without authentication, successful exploitation relies on winning a race condition and causes only a denial of service without compromising system confidentiality or integrity. Within Red Hat environments, exposure is limited to network services and server applications built with the Go runtime that actively handle HTTP/2 connections. Applications communicating strictly over HTTP/1.1 or where client connections do not modify header compression parameters are not vulnerable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548337",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548337"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97032",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847188",
          "url": "https://go.dev/cl/847188"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/847313",
          "url": "https://go.dev/cl/847313"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/81867",
          "url": "https://go.dev/issue/81867"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI",
          "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs",
          "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6617",
          "url": "https://pkg.go.dev/vuln/GO-2026-6617"
        }
      ],
      "release_date": "2026-10-08T22:54:00.230000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "Disable HTTP/2 server processing in affected Go applications by setting the environment variable GODEBUG=http2server=0, or restrict network exposure to trusted clients.\n\nFor applications managed by systemd, configure the environment variable by creating a service override:\n\nsystemctl edit \u003cservice-name\u003e\n\nAdd the following lines under the [Service] section:\n\n[Service]\nEnvironment=\"GODEBUG=http2server=0\"\n\nApply the changes and restart the daemon:\n\nsystemctl daemon-reload\nsystemctl restart \u003cservice-name\u003e\n\nTo limit network exposure using firewalld, restrict access to trusted networks:\n\nfirewall-cmd --zone=trusted --add-source=\u003ctrusted-ip-range\u003e --permanent\nfirewall-cmd --reload\n\nCaveats:\nDisabling HTTP/2 forces incoming client traffic to HTTP/1.1 and will break protocols that require HTTP/2, such as gRPC.\n\nWarning: Reloading systemd configurations and restarting the service or firewall will briefly interrupt active network sessions and cause temporary service unavailability.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
          "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6809",
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-29T15:19:54+00:00",
          "details": "See Red Hat OpenShift Service Mesh 3.3.9 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.3",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:92509"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:00f133eba1ca452484f115e11172529160ce9979d0295ffb498a8d1fef47cc7d_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:32df53a9f8767a628cde8e52965f904a6924b2468719e98a3218601777541b56_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:ad06388a57f119ac27726b7bbdcc2547736d5fe2f05c201384cfea65a39e12c9_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-cni-rhel9@sha256:e2181f016a28b7ec2260692be5c03326143e2085dcc90f0aa7c8755aad5e7dad_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:1c535a1289a02d1c6ffac61a23d8c9302730eb725563e56354a33258c4a5643d_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:d6718fe4b85294755716aa9b3c5eac7db8dea71eb0c8fef69d83f9d003e3af86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:db6564a62b46e0d2c16417fa277dd205f0272959b0f3dea777b8949523764986_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel9@sha256:f274e2433d4947506248628a2bafcef578aa2a6d041893e37feb56e861e000be_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:1e3c275246637983b6db7bfe11398c0cf4d3f949aa955851a7e5e08c1d083998_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:6cf99b928694662bc52b8875f5b6460b7a1212f4e3595a051f1168c1d95b91e3_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:a8581e4c7c168d82c42a0d02630c43b416a956a96759b55fb2c7641629a06c0c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9@sha256:ca0b379042b1748a38c69f68664542e0338830b0e900ff87bb57f461e9b58c23_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:20a66bb66ba070274bed4d56bbfee10d80d4522a3075c5b9eb6bbf76d45b62b1_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:6c378fb6bdb6737995e9651d03c6f82d296ad06cf8073710e6cf77fdeb524e86_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9220f312021752ec381beec4b18acf028469e2bebb169f9ffc6592f3a3892997_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9@sha256:9d4a1410002918f33ce2a2be33258c7c731553902bc2b34268c69bee47363827_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:12cd06f85cbb0d32b40b1b19a98d145983171ef877f5015e4cb190431a60d2b2_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:3d36b01816ae14a0ef6f57c50f184b068afdf9ea072377d7d083f36b94c7d76a_ppc64le",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:633cd008737a2b6762720490dae423fc65bbb37fc27144eac4f71898708ed93c_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-rhel9-operator@sha256:dc81b4e854909d335a6d63ca3c01cfa6606f72b64d911bd1d3a696d3ad06d96b_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-sail-operator-bundle@sha256:f2594dc24ac54b755639b7a3e58720d826f4cabc8b063df8c0c7369ca3775dc0_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:189da90fa23ada89edb2c404e458480e52ffb92279c6e44feaa2b8ec7c290c5e_arm64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:4151b54550cef0b365899e4c5300410f085b8642d53ee38c1b20339ccfb4248d_amd64",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:97eb3ede2542d3aadb72046fd6572b0f6addecec392d826b9c3b5016e215a691_s390x",
            "Red Hat OpenShift Service Mesh 3.3:registry.redhat.io/openshift-service-mesh/istio-ztunnel-rhel9@sha256:ce4a66efb423655a5adbf648cdb021632c9a72acaf9b943b8512e5a0e8f45108_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.