IS
Product
istio
27
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 17Medium 5Low 2
Watch
Add istio to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-31045 | 9.8 | Jun 9 | Istio is an open platform to connect, manage, and secure microservices Affected: before 1.12.8; 1.13.0 before 1.13.5; 1.14.0 |
| CVE-2022-21679 | 9.8 | Jan 19 | Istio is an open platform to connect, manage, and secure microservices Affected: 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; +3 more |
| CVE-2021-31921 | 9.8 | Jun 2 | Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing… Affected: before 1.8.6; 1.9.0 before 1.9.5 |
| CVE-2022-21701 | 8.8 | Jan 19 | Istio is an open platform to connect, manage, and secure microservices Affected: 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; 1.12.0; +3 more |
| CVE-2021-34824 | 8.8 | Jun 29 | Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can… Affected: 1.8.0 before 1.9.6; 1.10.0 before 1.10.2 |
| CVE-2026-41413 | 7.7 | May 7 | Istio Vulnerable to SSRF via RequestAuthentication jwksUri Affected: < 1.28.6; >= 1.29.0-alpha.0, < 1.29.2 |
| CVE-2026-31837 | 7.5 | Mar 10 | Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. Affected: >= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8 |
| CVE-2022-39278 | 7.5 | Oct 13 | Istio vulnerable to denial of service attack due to Golang Regex Library Affected: < 1.13.9; >= 1.14.0, < 1.14.5; >= 1.15.0, < 1.15.2 |
| CVE-2022-24726 | 7.5 | Mar 10 | Istio is an open platform to connect, manage, and secure microservices Affected: before 1.11.8; 1.12.0 before 1.12.5; 1.13.0 before 1.13.2 |
| CVE-2022-23635 | 7.5 | Feb 22 | Istio is an open platform to connect, manage, and secure microservices Affected: before 1.11.7; 1.12.0 before 1.12.4; 1.13.0 before 1.13.1 |
| CVE-2021-39156 | 7.5 | Aug 24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data Affected: before 1.9.8; 1.10.0 before 1.10.3; 1.11.0 before 1.11.1 |
| CVE-2021-39155 | 7.5 | Aug 24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data Affected: before 1.9.8; 1.10.0 before 1.10.4; 1.11.0 before 1.11.1 |
| CVE-2020-10739 | 7.5 | Jun 2 | Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could… Affected: 1.4.0 before 1.4.9; 1.5.0 before 1.5.4 |
| CVE-2019-18817 | 7.5 | Nov 12 | Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836 Affected: 1.3 before 1.3.5 |
| CVE-2019-18836 | 7.5 | Nov 11 | Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy… Affected: 1.3.0 through 1.3.3 |
| CVE-2019-14993 | 7.5 | Aug 13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding,… Affected: before 1.1.13; 1.2.0 before 1.2.4 |
| CVE-2019-12995 | 7.5 | Jun 28 | Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy Affected: before 1.2.2 |
| CVE-2019-12243 | 7.5 | Jun 5 | Istio 1.1.x through 1.1.6 has Incorrect Access Control Affected: 1.1 through 1.1.6 |
| CVE-2020-8843 | 7.4 | Feb 14 | An issue was discovered in Istio 1.3 through 1.3.6 Affected: 1.3.0 through 1.3.6 |
| CVE-2020-8595 | 7.3 | Feb 12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass Affected: 1.3 through 1.3.7; 1.4.0 through 1.4.3 |
| CVE-2020-16844 | 6.8 | Oct 1 | In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g Affected: 1.5.0 through 1.5.8; 1.6.0 through 1.6.7 |
| CVE-2021-31920 | 6.5 | May 27 | Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could… Affected: before 1.8.6; 1.9.0 before 1.9.5 |
| CVE-2019-25014 | 6.5 | Jan 29 | A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0 Affected: through 1.4.9 |
| CVE-2026-39350 | 5.4 | Apr 15 | Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass Affected: >= 1.25.0, < < 1.27.9; >= 1.28.0, < 1.28.6; >= 1.29.0, < 1.29.2 |
| CVE-2026-31838 | 5.3 | Mar 10 | Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. Affected: >= 1.29.0-alpha.0, < 1.29.1; >= 1.28.0-alpha.0, < 1.28.5; < 1.27.8 |
| CVE-2022-39388 | 3.5 | Nov 10 | Istio is an open platform to connect, manage, and secure microservices Affected: 1.15.0 through 1.15.2 |
| CVE-2020-11767 | 3.1 | Apr 15 | Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue Affected: through 1.5.1 |
Showing 27