CVE-2022-31045
Ill-formed headers may lead to unexpected behavior in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Ill-formed headers may lead to unexpected behavior in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-31045- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2022-6197
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
EUVD-2022-6197- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xwx5-5c9g-x68x
Ill-formed headers may lead to unexpected behavior in Istio
Impact
Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.
You are at most risk if you have an Istio ingress Gateway exposed to external traffic.
Patches
1.12.8, 1.13.5, 1.14.1
Workarounds
No.
References
More details can be found in the Istio Security Bulletin
For more information
If you have any questions or comments about this advisory, please email us at [email protected]
- Record
GHSA-xwx5-5c9g-x68x- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-31045- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
Ill-formed headers may lead to unexpected behavior in Istio
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
- Record
CVE-2022-31045- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVGHSA-xwx5-5c9g-x68x
Ill-formed headers may lead to unexpected behavior in Istio
Impact
Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.
You are at most risk if you have an Istio ingress Gateway exposed to external traffic.
Patches
1.12.8, 1.13.5, 1.14.1
Workarounds
No.
References
More details can be found in the Istio Security Bulletin
For more information
If you have any questions or comments about this advisory, please email us at [email protected]
- Record
GHSA-xwx5-5c9g-x68x- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHSA-2022:5004
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.3 security update
- Record
RHSA-2022:5004- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
istio.io/istioGo |
before 1.12.18 | 1.12.18 |
istio.io/istioGo |
1.13.0 up to 1.13.5 | 1.13.5 |
istio.io/istioGo |
1.14.0 up to 1.14.1 | 1.14.1 |
servicemeshRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-cniRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-operatorRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-2.el8 | 0:2.1.3-2.el8 |
servicemesh-pilot-agentRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-pilot-discoveryRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-prometheusRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.23.0-7.el8 | 0:2.23.0-7.el8 |
servicemesh-proxyRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
servicemesh-proxy-debuginfoRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-proxy-debugsourceRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-proxy-wasmRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
servicemesh-ratelimitRed Hat:service_mesh:2.1::el8 From an advisory covering 8 CVEs |
before 0:2.1.3-1.el8 | 0:2.1.3-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31045 is a high vulnerability (CVSS 7.0) in Istio, published June 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in istio.io/istio 1.12.18.
References
github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
istio.io/latest/news/security/istio-security-2022-05
nvd.nist.gov/vuln/detail/CVE-2022-31045
Show 43 moreShow less
access.redhat.com/errata/RHSA-2022:5004
docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
bugzilla.redhat.com/show_bug.cgi?id=2053429
issues.redhat.com/browse/OSSM-1107
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5004.json
cve.org/CVERecord?id=CVE-2022-23772
groups.google.com/g/golang-announce/c/SUsQn0aSgPQ