VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

istio.io/istio: vulnerability history, versions and safety

istio.io/istio is a package in the Go ecosystem. Vulert records 13 vulnerabilities for it across 120 releases, from Aug 2021 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
13 vulnerabilities recorded H6 M5 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
4 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all istio.io/istio vulnerabilities

Vulert verdict on istio.io/istio v0.0.0-20261021223355-ac152d313bbc i

Updated on 23 Oct 2026

Action needed: v0.0.0-20261021223355-ac152d313bbc has 7 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 78/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.0.0-20261021223355-ac152d313bbc — affected i
  • Vulnerabilities on record 13 over 4 years · 4 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 8.9 i
  • With no published fix 0 i
  • Stars 38,461 i
  • OpenSSF scorecard 4/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for istio.io/istio, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022001138-7209fe474ce6 22 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021234053-edd80bca5f71 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021223355-ac152d313bbc 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021205954-defaf94d89c8 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021192305-bc449c405707 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021183455-e3dcad182824 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021173953-2a2149afb127 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021170054-c89adcd803e0 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261021082854-eb2028358aaa 21 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261020195851-a1c252aee5d5 20 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261020191041-74309e3b4076 20 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261020164640-d43f12f82e22 20 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261020115459-c01d7716cd71 20 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019232500-388580f3dc1c 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019185200-ef2da6ac638a 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019172338-393efc9507c3 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019163059-6eddaf5684e8 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019160135-dc7fa0a81700 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019151659-6b4910717df4 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261019101059-ed388c1d169b 19 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261018191457-35c46fd94e5c 18 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261018160057-8165a8e8cf30 18 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261018025257-d0f7ef54abc3 18 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261017184656-6f45987843c6 17 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261017171533-4cae7a6a8a08 17 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261016184745-54ac6ecc52be 16 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261016161845-09ac5dc9344b 16 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261016013845-29d6cc2e8be9 16 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261015232946-93ffc7debcde 15 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261015162126-becee72cbe47 15 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261015132652-46c9beb34068 15 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261015131922-e2f3a7949a35 15 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261015131910-b85dac9587f2 15 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261014161551-4e2c1c576e33 14 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261014145655-5aa7bd34d5ee 14 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261014111252-896a0f9db391 14 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261014104101-d09540eeb126 14 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261014084851-48780903fa1a 14 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013204307-559f9b7d1088 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013180550-1dbeea560ee3 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013171450-68bd6adad9fb 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013162955-e54e864305fb 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013151740-38c81a06fb97 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013141515-d06ae73c9df5 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013132509-998fec7b6dd2 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013120825-4db58eb7aa14 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013092846-ffd5bbfd4e22 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261013035339-859d1113bd15 13 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261012224918-737d694fc48b 12 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261012204157-b5ce004b587b 12 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261011163624-696a26488f0c 11 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261011032022-7d0c444ef898 11 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261011024822-af9fef79f62c 11 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261010184622-e91e0fcf480b 10 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261010150423-0c22386d718c 10 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261010141123-63e9643361d8 10 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009201222-aa3b3439c451 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009193344-da3c4288bb6c 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009184622-bd559e559ec5 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009180323-a1e00cb52932 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009134521-59abc0e516e8 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009130122-784ffec3be0f 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009111931-a093e3f84412 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261009102122-d501e135abad 09 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008225320-e4350fd4d6c9 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008215721-d7e364d767a3 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008211521-ac41d83370ca 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008194722-846c0b1eaae0 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008180231-a8dce154a704 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008164422-4a9d1cfa11dd 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008142120-691cb6c4e5e5 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008130223-fc1ea744380e 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008110221-323fe80883fd 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008093121-bf56ad720e2f 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261008045519-03666db06ac5 08 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007190821-1c185fbb6673 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007174737-c60706d5f092 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007154737-cf45a1688408 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007150023-f38c0c48aede 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007134721-0978edae26da 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007132920-026139996dc8 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007115331-c0e18d2cf6a4 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261007082320-6835d5ed8468 07 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006163618-0fa0f8f2a920 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006125630-bed575460796 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006120928-47f6d41ed1f0 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006112818-6337ff4ad81c 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006034317-db074ed84644 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261006024818-b7c81a0c72a8 06 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261005190418-5e61118429bc 05 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261005171620-fa82556bad7f 05 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261005151020-303bf8828170 05 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261004025215-c945dafc09f1 04 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261003152716-e412490989da 03 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002192916-b32dee014b25 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002184616-4e186a4e5f9f 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002175817-b7fabb052754 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002172415-d1b2c28d8e5f 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002155914-2513ece035a3 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002152315-317505b1d733 02 Oct 2026 H3 M3 U1 Apache-2.0 Yes Details →
v0.0.0-20261002144616-d23b88bf8677 02 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261002123715-e89fb55380d1 02 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261002084314-dc77dca93901 02 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261001165018-0258343f395a 01 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261001161114-19953b53ccfd 01 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261001142814-97bef417aff5 01 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261001134813-95389caa5d89 01 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20261001131413-db6e1182defc 01 Oct 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930214259-c006a081a582 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930210558-dcfe5da4fbc2 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930195459-411f64e7cadd 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930183258-9146f0c870f0 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930155758-482e99debdb0 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260930030358-e17de9b1baae 30 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929184557-739c83a57548 29 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929163957-8ac8481b5021 29 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929160608-e492b7b2b1de 29 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929150659-bb3d0ef13861 29 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929090657-a95724d2e610 29 Sep 2026 H3 M3 U1 — Yes Details →
v0.0.0-20260929033056-785bf23f433c 29 Sep 2026 H3 M3 U1 — Yes Details →

The newest 120 of 16,530 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 2
  • 2022 7
  • 2026 4

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 4 of the 13 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for istio.io/istio

The 5 most severe of 13 vulnerabilities recorded for this package

Search all 13 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2019-12243: Vulnerability in Istio Package - Incorrect Access Control 8.9 high 1.1.7 15 Feb 2022
CVE-2021-39155: Authorization Policy Bypass Due to Case Insensitive Host Comparison in istio.io/istio 8.3 high 1.9.8 30 Aug 2021
CVE-2021-39156: Istio Fragments in Path May Lead to Authorization Policy Bypass 8.1 high 1.9.8 30 Aug 2021
CVE-2022-23635: Unauthenticated control plane denial of service attack in Istio 7.5 high 1.13.1 23 Feb 2022
CVE-2019-14993: Istio ReDoS Vulnerability 7.5 high 1.1.13 24 May 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About istio.io/istio

Is istio.io/istio safe to use?

Vulert records 13 vulnerabilities for istio.io/istio in Go: 0 critical, 6 high, 5 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is istio.io/istio's Vulert package health score?

Vulert scores istio.io/istio 78/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of istio.io/istio affected?

Yes. v0.0.0-20261021223355-ac152d313bbc, the version you would install today, has 7 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does istio.io/istio have?

13 vulnerabilities are recorded for istio.io/istio in the Go ecosystem: 0 critical, 6 high, 5 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new istio.io/istio vulnerabilities disclosed?

4 vulnerabilities were recorded for istio.io/istio in the last 12 months, and the oldest entry in this database dates to 30 Aug 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of istio.io/istio are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor istio.io/istio for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the istio.io/istio version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.