CVE-2019-14993: Istio ReDoS Vulnerability
Summary
CVE-2019-14993: Istio ReDoS Vulnerability. Affects istio.io/istio across 2 version ranges.
< 1.1.13
>= 1.2.0, < 1.2.4
Fixed in 1.1.13 or 1.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices. It is written in Go and is widely used in cloud-native applications. The vulnerability identified as CVE-2019-14993 affects Istio versions before 1.1.13 and 1.2.x before 1.2.4. This vulnerability arises from mishandling regular expressions for long URIs, which can lead to a denial of service during the use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
Vulnerability Detail
The vulnerability in Istio allows an attacker to launch a ReDoS (Regular Expression Denial of Service) attack by exploiting the mishandling of regular expressions for long URIs. This can result in a denial of service, impacting the availability of the affected Istio deployments. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to note that this vulnerability only affects Istio versions before 1.1.13 and 1.2.x before 1.2.4.
How To Fix
Latest published version: v0.0.0-20261021223355-ac152d313bbc as of 22 Oct 2026
go get istio.io/istio@v0.0.0-20261021223355-ac152d313bbcUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.131.1.13go get istio.io/istio@v1.1.13 -
>= 1.2.0, < 1.2.41.2.4go get istio.io/istio@v1.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the fixed versions of Istio as mentioned in the 'how_to_fix' section.
Conclusion
The Istio ReDoS vulnerability (CVE-2019-14993) is a high severity vulnerability that affects Istio versions before 1.1.13 and 1.2.x before 1.2.4. It is crucial to upgrade Istio to the fixed versions mentioned in the 'how_to_fix' section to mitigate the risk of a ReDoS attack. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for istio.io/istio →
FAQ
Istio is an open-source service mesh platform that provides traffic management, security, and observability for microservices.
A ReDoS (Regular Expression Denial of Service) attack is a type of denial of service attack where an attacker exploits inefficient regular expressions to cause a significant delay or hang in the processing of input data.
This vulnerability affects Istio versions before 1.1.13 and 1.2.x before 1.2.4.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the fixed versions of Istio.
Related vulnerabilities
Recent vulnerabilities recorded for istio.io/istio.
