{"id":"CVE-2019-14993","aliases":["GHSA-qcvw-82hh-gq38"],"url":"https://o3.security/vulnerability/CVE-2019-14993","summary":"Istio ReDoS Vulnerability","details":"Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.","published":"2019-08-13T18:15:13.117Z","modified":"2026-07-08T20:15:10.068322Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Go","name":"istio.io/istio","fixedVersion":"1.1.13"},{"ecosystem":"Go","name":"istio.io/istio","fixedVersion":"1.2.4"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://discuss.istio.io/t/upcoming-security-updates-in-istio-1-2-4-and-1-1-13/3383"},{"type":"ADVISORY","url":"https://istio.io/blog/2019/istio-security-003-004/"},{"type":"REPORT","url":"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164"},{"type":"REPORT","url":"https://github.com/envoyproxy/envoy/issues/7728"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T20:15:10.068322Z"}}