TI-2021-16542 Aliases CVE-2021-39156 GHSA-hqxw-mm44-gc4r

Fragments in Path May Lead to Authorization Policy Bypass

LOW 38CWE-863Published 2021-08-24 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.

Why it matters now

EPSS 0.01177 67th percentileScored 2026-11-07

Fix Fixed istio (istio): 1.9.8, 1.10.4, 1.11.1istio.io/istio (Go): 1.9.8, 1.10.4, 1.11.1Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
istio	istio	before 1.9.8; 1.10.0 to before 1.10.4; 1.11.0 to before 1.11.1	1.9.8, 1.10.4, 1.11.1	Patch available	CNA
—	istio.io/istio (Go)	before 1.9.8	1.9.8	Patch available	GHSA-hqxw-mm44-gc4r
—	istio.io/istio (Go)	1.10.0 to before 1.10.4	1.10.4	Patch available	GHSA-hqxw-mm44-gc4r
—	istio.io/istio (Go)	1.11.0 to before 1.11.1	1.11.1	Patch available	GHSA-hqxw-mm44-gc4r

istio Vendoristio Affected before 1.9.8; 1.10.0 to before 1.10.4; 1.11.0 to before 1.11.1 Fixed in 1.9.8, 1.10.4, 1.11.1 Patch available CNA
istio.io/istio (Go) Vendor— Affected before 1.9.8 Fixed in 1.9.8 Patch available GHSA-hqxw-mm44-gc4r
istio.io/istio (Go) Vendor— Affected 1.10.0 to before 1.10.4 Fixed in 1.10.4 Patch available GHSA-hqxw-mm44-gc4r
istio.io/istio (Go) Vendor— Affected 1.11.0 to before 1.11.1 Fixed in 1.11.1 Patch available GHSA-hqxw-mm44-gc4r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:istio:istio::::::::	before 1.9.8; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.1	Vulnerable	istio

cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* Versions before 1.9.8; 1.10.0 to before 1.10.3; 1.11.0 to before 1.11.1 Vulnerable ·istio

Remediation

Fix · CNA istio (istio) Fixed in 1.9.8, 1.10.4, 1.11.1
Fix · GHSA-hqxw-mm44-gc4r istio.io/istio (Go) Fixed in 1.9.8 Advisory →
Fix · GHSA-hqxw-mm44-gc4r istio.io/istio (Go) Fixed in 1.10.4 Advisory →
Fix · GHSA-hqxw-mm44-gc4r istio.io/istio (Go) Fixed in 1.11.1 Advisory →

Red Hat 2 advisories

RHSA-2021:3272 Released 2021-08-25 · Red Hat rating Important
Red Hat OpenShift Service Mesh 2.0.7.1 security update
- OpenShift Service Mesh 2.0 servicemesh-2.0.7-3.el8, servicemesh-istioctl-2.0.7-3.el8, servicemesh-mixc-2.0.7-3.el8 +4
RHSA-2021:3273 Released 2021-08-25 · Red Hat rating Important
Red Hat OpenShift Service Mesh 1.1.17.1 security update
- OpenShift Service Mesh 1.1 servicemesh-1.1.17-3.el8, servicemesh-citadel-1.1.17-3.el8, servicemesh-galley-1.1.17-3.el8 +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Service Mesh 1.1	Fixed	RHSA-2021:3273
OpenShift Service Mesh 2.0	Fixed	RHSA-2021:3272

Not affected: 2 products

OpenShift Service Mesh 1.1
OpenShift Service Mesh 2.0

Timeline

2026-10-02 Threatist record created from CVE-2021-39156
2026-10-03 Alias added: GHSA-hqxw-mm44-gc4r

References

Advisory 3

Other 1

https://github.com/istio/istio

TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2022-06055 Authorization Policy bypass in Istio CVSS 3.1CRITICAL 9.8
TI-2021-11909 Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability… CVSS 3.1CRITICAL 9.8
TI-2026-24390 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails. CVSS 4.0HIGH 8.7
TI-2022-13090 Ill-formed headers may lead to unexpected behavior in Istio CVSS 3.1CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences