Issued:

2026-06-29

Updated:

2026-06-29

RHSA-2026:33123 - Red Hat OpenShift Service Mesh 3.1.10

Synopsis

Red Hat OpenShift Service Mesh 3.1.10

Type/Severity

Security Advisory Important

Topic

Red Hat OpenShift Service Mesh 3.1.10

This update has a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh 3.1.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

• CVE-2026-39820 openshift-golang-builder-container: Go net/mail: Denial of Service via crafted email inputs (OSSM-14266)
• CVE-2026-42499 openshift-golang-builder-container: net/mail: Denial of Service via pathological email address parsing (OSSM-14501)
• CVE-2026-33814 openshift-golang-builder-container: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (OSSM-14549)
• CVE-2026-33811 openshift-golang-builder-container: Go net package: Denial of Service via long CNAME response in LookupCNAME (OSSM-14562)

Solution

See Red Hat OpenShift Service Mesh 3.1.10 documentation at https://docs.redhat.com/en/documentation/red_hat_openshift_service_mesh/3.1

Affected Products

Fixes

(none)

CVEs

• CVE-2026-33811
• CVE-2026-33814
• CVE-2026-39820
• CVE-2026-42499

References

• https://access.redhat.com/security/updates/classification/

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at Security Contacts and Procedures.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.