# istio.io/istio (Go) vulnerabilities

10 known vulnerabilities (4 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/istio.io/istio

## Advisories (10)

### [CVE-2026-41413](https://cve.now/CVE-2026-41413): Istio Vulnerable to SSRF via RequestAuthentication jwksUri

- Severity: Medium 5.0
- Published: May 7, 2026
- Affected: fixed in 0.0.0-20260410004459-189832a289c1.

### [CVE-2026-39350](https://cve.now/CVE-2026-39350): Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

- Severity: Medium 5.4
- Published: Apr 15, 2026
- Affected: from 0.0.0-20241024090207-0bf27d49ba4b, fixed in 0.0.0-20260403004500-692e460c342d.

### [CVE-2022-31045](https://cve.now/CVE-2022-31045): Ill-formed headers may lead to unexpected behavior in Istio

- Severity: High 7.0
- Published: Jun 9, 2022
- Affected: fixed in 1.12.18; from 1.13.0, fixed in 1.13.5; from 1.14.0, fixed in 1.14.1.

### [CVE-2022-23635](https://cve.now/CVE-2022-23635): Unauthenticated control plane denial of service attack in Istio

- Severity: High 7.5
- Published: Feb 22, 2022
- Affected: from 1.13.0, fixed in 1.13.1; from 1.12.0, fixed in 1.12.4; fixed in 1.11.7.

### [CVE-2021-39156](https://cve.now/CVE-2021-39156): Fragments in Path May Lead to Authorization Policy Bypass

- Severity: High 8.1
- Published: Aug 24, 2021
- Affected: fixed in 1.9.8; from 1.10.0, fixed in 1.10.4; from 1.11.0, fixed in 1.11.1.

### [CVE-2021-39155](https://cve.now/CVE-2021-39155): Authorization Policy Bypass Due to Case Insensitive Host Comparison

- Severity: High 8.3
- Published: Aug 24, 2021
- Affected: fixed in 1.9.8; from 1.10.0, fixed in 1.10.4; from 1.11.0, fixed in 1.11.1.

### [CVE-2020-16844](https://cve.now/CVE-2020-16844): In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using…

- Severity: Unrated
- Published: Oct 1, 2020
- Affected: from 1.5.0, fixed in 1.5.9; from 1.6.0, fixed in 1.6.8.

### [CVE-2019-18817](https://cve.now/CVE-2019-18817): Istio 1.3.x before 1.3.5 allows Denial of Service because continue\_on\_listener\_filters\_timeout is set to True, a related issue to…

- Severity: Unrated
- Published: Nov 12, 2019
- Affected: from 1.3.0, fixed in 1.3.5.

### [CVE-2019-14993](https://cve.now/CVE-2019-14993): Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the…

- Severity: Unrated
- Published: Aug 13, 2019
- Affected: fixed in 1.1.13; from 1.2.0, fixed in 1.2.4.

### [CVE-2019-12243](https://cve.now/CVE-2019-12243): Istio 1.1.x through 1.1.6 has Incorrect Access Control.

- Severity: Unrated
- Published: Jun 5, 2019
- Affected: from 1.1.0, fixed in 1.1.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/istio.io/istio
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.