Skip to content
Noroxi

istio records

29 published records for vendor istio.

Researcher profile

Entered KEV
2 · 6.9%
Weaponized
2 · 6.9%
Pre-auth RCE
1
With a fix record
72.4%
Median publish → KEV
3 days

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

29 records
  • CVE-2026-111497
    91Now

    Out-of-Bounds Write in Google Brotli Decoder

    CriticalCVSS 9.2KEVWeaponizedEPSS 82%

    google · brotliOct 22, 2026

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2021-31921
    39Monitor

    Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected servi

    CriticalCVSS 9.8No exploitEPSS 1%

    istio · istioJun 2, 2021

  • CVE-2022-31045
    39Monitor

    Ill-formed headers may lead to unexpected behavior in Istio

    CriticalCVSS 9.8No exploitEPSS 1%

    istio · istioJun 9, 2022

  • CVE-2022-21679
    39Monitor

    Authorization Policy bypass in Istio

    CriticalCVSS 9.8No exploitEPSS 1%

    istio · istioJan 19, 2022

  • CVE-2021-34824
    36Monitor

    Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and De

    HighCVSS 8.8Proof of conceptEPSS 1%

    istio · istioJun 29, 2021

  • CVE-2022-21701
    35Monitor

    Privileged Escalation in Istio

    HighCVSS 8.8No exploitEPSS 0%

    istio · istioJan 19, 2022

  • CVE-2026-31837
    34Monitor

    Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.

    HighCVSS 8.7No exploitEPSS 0%

    istio · istioMar 10, 2026

  • CVE-2020-10739
    31Monitor

    Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a special

    HighCVSS 7.5No exploitEPSS 2%

    istio · istioJun 2, 2020

  • CVE-2019-14993
    31Monitor

    Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JW

    HighCVSS 7.5No exploitEPSS 2%

    istio · istioAug 13, 2019

  • CVE-2019-12995
    31Monitor

    Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy.

    HighCVSS 7.5No exploitEPSS 2%

    istio · istioJun 28, 2019

  • CVE-2019-18836
    31Monitor

    Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep

    HighCVSS 7.5No exploitEPSS 1%

    envoyproxy · envoyNov 10, 2019

  • CVE-2020-8595
    30Monitor

    Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.

    HighCVSS 7.3No exploitEPSS 2%

    istio · istioFeb 12, 2020

  • CVE-2022-23635
    30Monitor

    Unauthenticated control plane denial of service attack in Istio

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioFeb 22, 2022

  • CVE-2022-24726
    30Monitor

    Unauthenticated control plane denial of service attack in Istio

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioMar 10, 2022

  • CVE-2022-39278
    30Monitor

    Istio vulnerable to denial of service attack due to Golang Regex Library

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioOct 13, 2022

  • CVE-2021-39155
    30Monitor

    Authorization Policy Bypass Due to Case Insensitive Host Comparison

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioAug 24, 2021

  • CVE-2019-18817
    30Monitor

    Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-1

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioNov 12, 2019

  • CVE-2021-39156
    30Monitor

    Fragments in Path May Lead to Authorization Policy Bypass

    HighCVSS 7.5Proof of conceptEPSS 1%

    istio · istioAug 24, 2021

  • CVE-2019-12243
    30Monitor

    Istio 1.1.x through 1.1.6 has Incorrect Access Control.

    HighCVSS 7.5No exploitEPSS 1%

    istio · istioJun 5, 2019

  • CVE-2026-41413
    30Monitor

    Istio Vulnerable to SSRF via RequestAuthentication jwksUri

    HighCVSS 7.7No exploitEPSS 0%

    istio · istioMay 7, 2026

  • CVE-2020-8843
    29Monitor

    An issue was discovered in Istio 1.3 through 1.3.6.

    HighCVSS 7.4No exploitEPSS 1%

    istio · istioFeb 14, 2020

  • CVE-2020-16844
    27Monitor

    In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildca

    MediumCVSS 6.8No exploitEPSS 1%

    istio · istioOct 1, 2020

  • CVE-2026-31838
    27Monitor

    Istio HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access.

    MediumCVSS 6.9No exploitEPSS 0%

    istio · istioMar 10, 2026

  • CVE-2019-25014
    26Monitor

    A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.

    MediumCVSS 6.5No exploitEPSS 1%

    istio · istioJan 29, 2021