Priority CRITICAL 99KEV
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.82641 · Published 2026-10-22 · Partial fix · 1.0.10, 1.1.1 +2 CWE-252
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 45
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0107 · Published 2022-01-19 · Partial fix · 1.12.2 CWE-670
Priority MEDIUM 45
Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01454 · Published 2021-06-02 · Fixed CWE-862
Priority MEDIUM 44
Istio is an open platform to connect, manage, and secure microservices.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0044 · Published 2026-03-10 · Partial fix · 1.29.1, 1.28.5 +1 CWE-200
Priority MEDIUM 44
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01192 · Published 2022-06-09 · Partial fix · 1.12.18, 1.13.5 +1 CWE-125
Priority MEDIUM 42
Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01436 · Published 2022-10-13 · Partial fix · 1.13.9, 1.14.5 +1 CWE-400
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01591 · Published 2022-03-10 · Partial fix · 1.12.5, 1.13.2 CWE-400
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01651 · Published 2022-02-22 · Fixed in 1.13.1, 1.12.4 +1 CWE-287
Priority MEDIUM 42
Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01988 · Published 2021-06-29 · No fix listed
Priority LOW 39
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00767 · Published 2022-01-19 · Partial fix · 1.12.2 CWE-863
Priority LOW 39
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.01242 · Published 2021-08-24 · Fixed in 1.10.4, 1.11.1 +1 CWE-178
Priority LOW 38
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.01177 · Published 2021-08-24 · Fixed in 1.9.8, 1.10.4 +1 CWE-863
Priority LOW 37
Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02389 · Published 2020-06-02 · Fixed in 1.4.9, 1.5.4 CWE-476
Priority LOW 37
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.02627 · Published 2020-02-12 · Fixed CWE-287
Priority LOW 37
Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_time…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01938 · Published 2019-11-11 · No fix listed CWE-835
Priority LOW 37
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02275 · Published 2019-08-13 · Fixed in 1.1.13, 1.2.4 CWE-185
Priority LOW 37
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02193 · Published 2019-06-28 · No fix listed CWE-476
Priority LOW 36
Istio is an open platform to connect, manage, and secure microservices.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00251 · Published 2026-03-10 · Partial fix · 1.29.1, 1.28.5 +1 CWE-863
Priority LOW 35
An issue was discovered in Istio 1.3 through 1.3.6.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01065 · Published 2020-02-14 · No fix listed CWE-20
Priority LOW 35
Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-18836.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01214 · Published 2019-11-12 · Fixed in 1.3.5 CWE-835
Priority LOW 35
Istio 1.1.x through 1.1.6 has Incorrect Access Control.
CVSS 3.0HIGH 7.5· Adjacent network · No auth · No interaction · EPSS 0.01175 · Published 2019-06-05 · Fixed in 1.1.7 CWE-284
Priority LOW 34
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00329 · Published 2026-05-07 · Partial fix · 1.28.6, 1.29.2 +1 CWE-918
Priority LOW 34
Istio is an open platform to connect, manage, and secure microservices.
CVSS 3.1HIGH 7.6· Adjacent network · Low privileges · No interaction · EPSS 0.00531 · Published 2022-11-10 · Fixed in 1.15.3 CWE-863
Priority LOW 32
Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01316 · Published 2021-05-27 · Fixed CWE-706
Load more
THREATIST.IORead the docs