IS
Vendor
istio
28
CVEs
1
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | IS Istio Istio | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-41413 | IS istio istio | 7.7 | May 7 | Istio Vulnerable to SSRF via RequestAuthentication jwksUri |
| CVE-2026-39350 | IS istio istio | 5.4 | Apr 15 | Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass |
| CVE-2026-31838 | IS istio istio | 5.3 | Mar 10 | Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. |
| CVE-2026-31837 | IS istio istio | 7.5 | Mar 10 | Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. |
| CVE-2022-39388 | IS Istio Istio | 3.5 | Nov 10 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2022-39278 | IS istio istio | 7.5 | Oct 13 | Istio vulnerable to denial of service attack due to Golang Regex Library |
| CVE-2022-31045 | IS Istio Istio | 9.8 | Jun 9 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2022-24726 | IS Istio Istio | 7.5 | Mar 10 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2022-23635 | IS Istio Istio | 7.5 | Feb 22 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2022-21701 | IS Istio Istio | 8.8 | Jan 19 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2022-21679 | IS Istio Istio | 9.8 | Jan 19 | Istio is an open platform to connect, manage, and secure microservices |
| CVE-2021-39156 | IS Istio Istio | 7.5 | Aug 24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data |
| CVE-2021-39155 | IS Istio Istio | 7.5 | Aug 24 | Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data |
| CVE-2021-34824 | IS Istio Istio | 8.8 | Jun 29 | Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can… |
| CVE-2021-31921 | IS Istio Istio | 9.8 | Jun 2 | Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing… |
| CVE-2021-31920 | IS Istio Istio | 6.5 | May 27 | Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could… |
| CVE-2019-25014 | IS Istio Istio | 6.5 | Jan 29 | A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0 |
| CVE-2020-16844 | IS Istio Istio | 6.8 | Oct 1 | In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g |
| CVE-2020-10739 | IS Istio Istio | 7.5 | Jun 2 | Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could… |
| CVE-2020-11767 | IS Istio Istio | 3.1 | Apr 15 | Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue |
| CVE-2020-8843 | IS Istio Istio | 7.4 | Feb 14 | An issue was discovered in Istio 1.3 through 1.3.6 |
| CVE-2020-8595 | IS Istio Istio | 7.3 | Feb 12 | Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass |
| CVE-2019-18817 | IS Istio Istio | 7.5 | Nov 12 | Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836 |
| CVE-2019-18836 | IS Istio Istio | 7.5 | Nov 11 | Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy… |
| CVE-2019-14993 | IS Istio Istio | 7.5 | Aug 13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding,… |
| CVE-2019-12995 | IS Istio Istio | 7.5 | Jun 28 | Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy |
| CVE-2019-12243 | IS Istio Istio | 7.5 | Jun 5 | Istio 1.1.x through 1.1.6 has Incorrect Access Control |