title: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update
description: golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation nodejs-axios: Regular expression denial of service in trim function ulikunitz/xz: Infinite loop in readUvarint allows for denial of service golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet golang: net/http/httputil: panic due to racy read of persistConn after handler panic golang.org/x/crypto: empty plaintext packet causes panic envoy: Null pointer dereference when using JWT filter safe_regex match envoy: Use-after-free when response filters increase response data envoy: Use-after-free when tunneling TCP over HTTP envoy: Incorrect configuration handling allows mTLS session re-use without re-validation envoy: Incorrect handling of internal redirects to routes with a direct response entry envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service istio: unauthenticated control plane denial of service attack istio: Unauthenticated control plane denial of service attack due to stack exhaustion
cpes: cpe:/a:redhat:service_mesh:2.0::el8