Description
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | ior +1 | 1.1.0-3.el8 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | kiali | v1.12.7.redhat1-1.el7 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | servicemesh +8 | 1.1.0-5.el8 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.4.3-2.el8 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | servicemesh-operator | 1.1.0-9.el8 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.14.0-3.el8 | RHEA-2020:1416 |
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.1.0-4.el8 | RHEA-2020:1416 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | istio.io/istio | < 1.1.13 | 1.1.13 | GHSA-qcvw-82hh-gq38 |
| Go | istio.io/istio | >= 1.2.0, < 1.2.4 | 1.2.4 | GHSA-qcvw-82hh-gq38 |
Advisories 1
- RHEA-2020:1416 Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.1.0 RPMs Red Hat Security Advisories (RHSA) · Jun 27, 2026