https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T03:19:26.649540+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-30445 EUVD-2026-30445 2026-10-04T03:19:26.721710+00:00 EUVD-2026-30445 https://cve.radiocsirt.org/vuln/fkie_cve-2021-39156 fkie_cve-2021-39156 2026-10-04T03:19:26.721747+00:00

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.

 https://cve.radiocsirt.org/vuln/ghsa-hqxw-mm44-gc4r GHSA-hqxw-mm44-gc4r — Istio Fragments in Path May Lead to Authorization Policy Bypass 2026-10-04T03:19:26.721790+00:00

Affected: Go: istio.io/istio

### Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies.

### Patches * Istio 1.11.1 and above * Istio 1.10.4 and above * Istio 1.9.8 and above

### Workarounds A Lua filter may be written to normalize the path. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)

### For more information If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com

 https://cve.radiocsirt.org/vuln/gsd-2021-39156 gsd-2021-39156 2026-10-04T03:19:26.721828+00:00 gsd-2021-39156 https://cve.radiocsirt.org/vuln/rhsa-2021:3272 RHSA-2021:3272 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.7.1 security update 2026-10-04T03:19:26.721841+00:00

envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies envoyproxy/envoy: denial of service when using extensions that modify request or response sizes istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison istio/istio: HTTP request with fragment in URI can bypass authorization mechanisms