CRITICAL9.3Go
GHSA-6g5f-f5pm-mjrg· CVE-2019-12243Istio may not check inbound TCP connections against istio-policy
Modified: 11/8/2023
package
Go/istio.io/istio
pkg:go/istio.io/istio
HIGH8.3Go
GHSA-7774-7vr3-cc8j· CVE-2021-39155Authorization Policy Bypass Due to Case Insensitive Host Comparison
Modified: 9/10/2026
MEDIUM6.8Go
GHSA-82mm-ffjr-h86c· CVE-2020-16844Authorization bypass in Istio
Modified: 11/8/2023
HIGH7.5Go
GHSA-856q-xv3c-7f2f· CVE-2022-23635Unauthenticated control plane denial of service attack in Istio
Modified: 9/10/2026
MEDIUM5.4Go
GHSA-9gcg-w975-3rjh· CVE-2026-39350, GO-2026-5289Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots
Modified: 9/10/2026
MEDIUM5.0Go
GHSA-fgw5-hp8f-xfhc· CVE-2026-41413, GO-2026-5363Istio: SSRF via RequestAuthentication jwksUri
Modified: 9/10/2026
HIGH8.1Go
GHSA-hqxw-mm44-gc4r· CVE-2021-39156Istio Fragments in Path May Lead to Authorization Policy Bypass
Modified: 9/10/2026
HIGH7.5Go
GHSA-qcvw-82hh-gq38· CVE-2019-14993Istio ReDoS Vulnerability
Modified: 9/10/2026
HIGH7.5Go
GHSA-vc7h-cmp3-4hw5· CVE-2019-18817Istio vulnerable to denial of service
Modified: 11/8/2023
MEDIUM5.9Go
GHSA-xwx5-5c9g-x68x· CVE-2022-31045Ill-formed headers may lead to unexpected behavior in Istio
Modified: 9/10/2026
—Go
GO-2026-5289· CVE-2026-39350, GHSA-9gcg-w975-3rjhIstio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots in istio.io/istio
Modified: 6/25/2026
—Go
GO-2026-5363· CVE-2026-41413, GHSA-fgw5-hp8f-xfhcIstio: SSRF via RequestAuthentication jwksUri in istio.io/istio
Modified: 6/28/2026