Vulnerability record · CVE-2022-31045 · published 9 June 2022

CVE-2022-31045: Istio out-of-bounds read vulnerability

Istio · Istio

Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.

9.8 CVSS 3.1 Critical EPSS 1.2% · top 33.5% CWE-125 · Out-of-bounds read

9.8CVSS 3.1 base score, v2 7.5

1.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Istio Istio

References

Link	Tags
https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x	Third Party Advisory
https://istio.io/latest/news/security/istio-security-2022-05	Broken Link
https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x	Third Party Advisory
https://istio.io/latest/news/security/istio-security-2022-05	Broken Link

Track CVE-2022-31045 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10 Oct 2023 9.8CVE-2022-21679Istio vulnerabilityIstio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts m…EPSS 1.1%19 Jan 2022 9.8CVE-2021-31921Istio missing authorization vulnerabilityIstio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in th…EPSS 1.5%2 Jun 2021 8.8CVE-2022-21701Istio incorrect authorization vulnerabilityIstio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation a…EPSS 0.77%19 Jan 2022 8.8CVE-2021-34824Istio vulnerabilityIstio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and Destination…EPSS 2.0%29 Jun 2021 8.7CVE-2026-31837Istio information exposure vulnerabilityIstio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS …EPSS 0.68%10 Mar 2026 7.7CVE-2026-41413Istio server-side request forgery (ssrf) vulnerabilityIstio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is…EPSS 0.45%7 May 2026 7.5CVE-2022-39278Istio uncontrolled resource consumption vulnerabilityIstio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions …EPSS 1.2%13 Oct 2022

Source: NIST National Vulnerability Database (record CVE-2022-31045), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.