Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 75
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.87286 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 74
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.82813 · Published 2019-08-13 · Partial fix · 0.0.0-20190813141303-74dc4d7220e7 CWE-400
Priority HIGH 73
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.81556 · Published 2019-08-13 · Partial fix CWE-400
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-06-11 · Partial fix · 1.15.2, 0.31.1 CWE-1321
Priority HIGH 67
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.59547 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 62
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.57461 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 55
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27004 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 54
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.25448 · Published 2019-08-13 · Partial fix CWE-400
Priority MEDIUM 50
A signature verification vulnerability exists in crewjam/saml.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04931 · Published 2020-12-21 · Partial fix · 0.4.3 CWE-115
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 44
A flaw was found in servicemesh-operator.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01029 · Published 2022-08-22 · Fixed CWE-1188
Priority MEDIUM 43
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.03468 · Published 2020-03-26 · Fixed in 1.15.1 CWE-321
Priority MEDIUM 42
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0).
CVSS 3.1HIGH 8.3· Network · No auth · No interaction · EPSS 0.03732 · Published 2019-04-25 · Fixed CWE-74
Priority MEDIUM 41
Envoy is an open source edge and service proxy designed for cloud-native applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00967 · Published 2026-06-17 · Fixed in 1.35.11, 1.36.7 +2 CWE-405
Priority MEDIUM 40
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00969 · Published 2021-06-01 · Partial fix · 1.33.0 CWE-281
Priority MEDIUM 40
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using tha…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01153 · Published 2020-04-27 · Fixed in 1.15.1 CWE-384
Priority LOW 37
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01869 · Published 2020-03-04 · Fixed CWE-400
Priority LOW 37
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01887 · Published 2020-03-04 · Fixed CWE-770
Priority LOW 37
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.02627 · Published 2020-02-12 · Fixed CWE-287
Priority LOW 34
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00275 · Published 2020-02-17 · Fixed in 1.0.8 CWE-266
Priority LOW 32
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00424 · Published 2025-01-28 · No fix listed CWE-444
Priority LOW 32
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01345 · Published 2021-01-29 · Fixed CWE-476
Priority LOW 21
A content spoofing vulnerability was found in Kiali.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00738 · Published 2023-09-23 · Partial fix · 1.57.5-3, 1.57.4 CWE-74
THREATIST.IORead the docs