Search for vulnerabilities
Vulnerability details: VCID-2cyz-8huy-aaae
Vulnerability ID VCID-2cyz-8huy-aaae
Aliases CVE-2022-31045
GHSA-xwx5-5c9g-x68x
Summary Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-125 Out-of-bounds Read
System Score Found at
rhas Critical https://access.redhat.com/errata/RHSA-2022:5004
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31045.json
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00137 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00146 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00213 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00225 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
epss 0.00278 https://api.first.org/data/v1/epss?cve=CVE-2022-31045
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2088819
cvssv3.1 7.6 https://github.com/istio/istio
generic_textual HIGH https://github.com/istio/istio
cvssv3.1 5.9 https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
cvssv3.1 7 https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
generic_textual MODERATE https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
ssvc Track https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
cvssv3.1 5.9 https://istio.io/latest/news/security/istio-security-2022-05
cvssv3.1 7 https://istio.io/latest/news/security/istio-security-2022-05
generic_textual MODERATE https://istio.io/latest/news/security/istio-security-2022-05
ssvc Track https://istio.io/latest/news/security/istio-security-2022-05
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31045
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-31045
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2022-31045
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31045.json
https://api.first.org/data/v1/epss?cve=CVE-2022-31045
https://github.com/istio/istio
https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
https://istio.io/latest/news/security/istio-security-2022-05
2088819 https://bugzilla.redhat.com/show_bug.cgi?id=2088819
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:1.14.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:istio:istio:1.14.0:*:*:*:*:*:*:*
CVE-2022-31045 https://nvd.nist.gov/vuln/detail/CVE-2022-31045
ISTIO-SECURITY-2022-005 https://istio.io/latest/news/security/ISTIO-SECURITY-2022-005/
ISTIO-SECURITY-2022-006 https://istio.io/latest/news/security/ISTIO-SECURITY-2022-006/
RHSA-2022:5004 https://access.redhat.com/errata/RHSA-2022:5004
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31045.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N Found at https://github.com/istio/istio
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:05:37Z/ Found at https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://istio.io/latest/news/security/istio-security-2022-05
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H Found at https://istio.io/latest/news/security/istio-security-2022-05
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:05:37Z/ Found at https://istio.io/latest/news/security/istio-security-2022-05
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31045
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31045
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31045
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.30241
EPSS Score 0.00137
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.