{"id":"CVE-2019-14993","aliases":["EUVD-2022-4952","GHSA-qcvw-82hh-gq38","RHEA-2020:1416"],"status":"published","title":"Istio ReDoS Vulnerability","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02275,"percentile":0.83208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185"],"published":"2019-08-13T17:38:39Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Go","package":"istio.io/istio","fixed_in":["1.1.13","1.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.13"}]}]},{"source":"osv","ecosystem":"Go","package":"istio.io/istio","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el7","package":"kiali","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.12.7.redhat1-1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"ior","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-9.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-5.el8"}]}],"bundled":2}],"products":[{"vendor":"istio","product":"istio"}],"references":[{"url":"https://discuss.istio.io/t/upcoming-security-updates-in-istio-1-2-4-and-1-1-13/3383","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/envoyproxy/envoy/issues/7728","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://istio.io/blog/2019/istio-security-003-004/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14993","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qcvw-82hh-gq38"},{"url":"https://istio.io/blog/2019/istio-security-003-004","tags":["web"]},{"url":"https://access.redhat.com/errata/RHEA-2020:1416","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/MAISTRA-907","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_1416.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14993","tags":["advisory"]},{"url":"https://istio.io/news/2019/istio-security-003-004/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15225","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14993","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2019-08-13T17:38:39Z","modified":"2024-08-05T00:34:53.164Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2022-4952","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2019-08-13T17:38:39Z","modified":"2024-08-05T00:34:53Z","updated_at":"2026-11-03T02:40:37.184704Z"}],"ghsa":[{"id":"GHSA-qcvw-82hh-gq38","title":"Istio ReDoS Vulnerability","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2022-05-24T16:53:16Z","modified":"2023-07-26T05:02:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2019-14993","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2019-08-13T18:15:13.117Z","modified":"2026-06-17T02:19:27.707Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"CVE-2019-14993","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2019-08-13T18:15:13.117Z","modified":"2026-10-24T10:30:50.570675724Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"GHSA-qcvw-82hh-gq38","title":"Istio ReDoS Vulnerability","description":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","status":"published","published":"2022-05-24T16:53:16Z","modified":"2026-09-10T03:48:20.430764488Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-185"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"RHEA-2020:1416","title":"Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.1.0 RPMs","status":"published","published":"2024-09-16T03:50:50Z","modified":"2026-06-27T10:08:55Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"}]}}