Read the docs
Red Hat Security Advisory

RHSA-2026:5952

Red Hat OpenShift Service Mesh 3.2.3

Released 2026-03-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 6 records

TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm

Unexpected session resumption in crypto/tls

Priority MEDIUM 51

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00902 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 +1 CWE-295
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4

Memory exhaustion in query parameter parsing in net/url

Priority MEDIUM 43

The net/url package does not set a limit on the number of query parameters in a query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02292 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6 CWE-770
TI-2025-38134 CVE-2025-61732 · GHSA-8jvr-vh7g-f8gx

Potential code smuggling via doc comments in cmd/cgo

Priority MEDIUM 40

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00531 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 CWE-94
TI-2025-38133 CVE-2025-61731 · GHSA-xvqr-69v8-f3gv

Arbitrary file write using cgo pkg-config directive in cmd/go

Priority LOW 37

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0061 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6