critical
CVE-2022-31045
Istio: Unsafe memory access in metadata exchange.
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Oracle (high), GHSA (medium), Red Hat (medium).
Description
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | cert-manager-istio-csr, cert-manager-istio-csr-fips, istio-pilot-agent-1.22 and 5 more | 0 |
| go::GitHub Security Advisory Go | istio.io/istio | 1.12.18, 1.13.5, 1.14.1 |
| Oracle Linux 7 | cri-o, cri-tools, etcd and 19 more | 1.23.3-1.el7 and 7 more |
| Oracle Linux 8 | cri-o, cri-tools, etcd and 19 more | 1.23.3-1.el8 and 7 more |
| Red Hat | servicemesh, servicemesh-istioctl, servicemesh-mixc and 3 more | no fix listed |
| wolfi | cert-manager-istio-csr | 0 |
Show all 60 entries from 6 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | cert-manager-istio-csr | 0 |
| chainguard | cert-manager-istio-csr-fips | 0 |
| chainguard | istio-pilot-agent-1.22 | 0 |
| chainguard | istio-pilot-discovery-1.22 | 0 |
| chainguard | kgateway-2.3 | 0 |
| chainguard | kgateway-2.4 | 0 |
| chainguard | kgateway-fips-2.3 | 0 |
| chainguard | kgateway-fips-2.4 | 0 |
| go::GitHub Security Advisory Go | istio.io/istio | 1.12.18, 1.13.5, 1.14.1 |
| Oracle Linux 7 | cri-o | 1.23.3-1.el7 |
| Oracle Linux 7 | cri-tools | 1.23.0-1.el7 |
| Oracle Linux 7 | etcd | 3.5.1-2.el7 |
| Oracle Linux 7 | istio | 1.13.7-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.13.7-1.el7 |
| Oracle Linux 7 | kata | 1.12.1-5.el7 |
| Oracle Linux 7 | kubeadm | 1.23.7-1.el7 |
| Oracle Linux 7 | kubectl | 1.23.7-1.el7 |
| Oracle Linux 7 | kubelet | 1.23.7-1.el7 |
| Oracle Linux 7 | olcne-agent | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-api-server | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-nginx | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-oci-csi-chart | 1.4.7-1.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.5.5-1.el7 |
| Oracle Linux 7 | olcne-utils | 1.5.5-1.el7 |
| Oracle Linux 7 | olcnectl | 1.5.5-1.el7 |
| Oracle Linux 8 | cri-o | 1.23.3-1.el8 |
| Oracle Linux 8 | cri-tools | 1.23.0-1.el8 |
| Oracle Linux 8 | etcd | 3.5.1-2.el8 |
| Oracle Linux 8 | istio | 1.13.7-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.13.7-1.el8 |
| Oracle Linux 8 | kata | 1.12.1-5.el8 |
| Oracle Linux 8 | kubeadm | 1.23.7-1.el8 |
| Oracle Linux 8 | kubectl | 1.23.7-1.el8 |
| Oracle Linux 8 | kubelet | 1.23.7-1.el8 |
| Oracle Linux 8 | olcne-agent | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-api-server | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-nginx | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-oci-csi-chart | 1.4.7-1.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.5.5-1.el8 |
| Oracle Linux 8 | olcne-utils | 1.5.5-1.el8 |
| Oracle Linux 8 | olcnectl | 1.5.5-1.el8 |
| Red Hat | servicemesh | no fix listed |
| Red Hat | servicemesh-istioctl | no fix listed |
| Red Hat | servicemesh-mixc | no fix listed |
| Red Hat | servicemesh-mixs | no fix listed |
| Red Hat | servicemesh-pilot-agent | no fix listed |
| Red Hat | servicemesh-pilot-discovery | no fix listed |
| wolfi | cert-manager-istio-csr | 0 |
References
- https://access.redhat.com/security/cve/CVE-2022-31045
- https://github.com/istio/istio
- https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
- https://istio.io/latest/news/security/istio-security-2022-005/#cve-2022-31045
- https://istio.io/latest/news/security/istio-security-2022-05
- https://linux.oracle.com/cve/CVE-2022-31045.html
- https://linux.oracle.com/errata/ELSA-2022-9774.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-31045