Istio - vulnerabilities (CVEs)
29 CVEs in 1 products, 1 in the last 30 days, newest from 2026-10-22.
Products
- Istio - 29 CVEs
Newest CVEs of Istio
- CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
- CVE-2026-41413 - CVSS 7.7 (high), 2026-05-07: Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created…
- CVE-2026-39350 - CVSS 5.4 (medium), 2026-04-15: Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the…
- CVE-2026-31838 - CVSS 6.9 (medium), 2026-03-10: Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching…
- CVE-2026-31837 - CVSS 8.7 (high), 2026-03-10: Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver…
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2022-39388 - CVSS 7.6 (high), 2022-11-10: Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload…
- CVE-2022-39278 - CVSS 7.5 (high), 2022-10-13: Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2,…
- CVE-2022-31045 - CVSS 9.8 (critical), 2022-06-09: Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can…
- CVE-2022-24726 - CVSS 7.5 (high), 2022-03-10: Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request…
- CVE-2022-23635 - CVSS 7.5 (high), 2022-02-22: Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request…
- CVE-2022-21679 - CVSS 9.8 (critical), 2022-01-19: Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be…
- CVE-2022-21701 - CVSS 8.8 (high), 2022-01-19: Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack.…
- CVE-2021-39156 - CVSS 8.1 (high), 2021-08-24: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and…
- CVE-2021-39155 - CVSS 8.3 (high), 2021-08-24: Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and…
- CVE-2021-34824 - CVSS 8.8 (high), 2021-06-29: Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule…
- CVE-2021-31921 - CVSS 9.8 (critical), 2021-06-02: Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the…
- CVE-2021-31920 - CVSS 6.5 (medium), 2021-05-27: Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash…
- CVE-2019-25014 - CVSS 6.5 (medium), 2021-01-29: A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request…
- CVE-2020-16844 - CVSS 6.8 (medium), 2020-10-01: In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g.…
- CVE-2020-10739 - CVSS 7.5 (high), 2020-06-02: Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet,…
- CVE-2020-11767 - CVSS 3.1 (low), 2020-04-15: Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request…
- CVE-2020-8843 - CVSS 7.4 (high), 2020-02-14: An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy…
- CVE-2020-8595 - CVSS 7.3 (high), 2020-02-12: Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path…
- CVE-2019-18817 - CVSS 7.5 (high), 2019-11-12: Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836.
- CVE-2019-18836 - CVSS 7.5 (high), 2019-11-11: Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread…
- CVE-2019-14993 - CVSS 7.5 (high), 2019-08-13: Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService,…
- CVE-2019-12995 - CVSS 7.5 (high), 2019-06-28: Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwt_authenticator.cc…
- CVE-2019-12243 - CVSS 7.5 (high), 2019-06-05: Istio 1.1.x through 1.1.6 has Incorrect Access Control.
