CVE-2019-25014

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-29 · updated 2026-06-17
Weakness: CWE-476

Description

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application).

Affected products

istio: through 1.4.9
Red Hat OpenShift Service Mesh 2: 1.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=1919066
https://github.com/istio/istio/compare/1.4.2...1.5.0-alpha.0
https://bugzilla.redhat.com/show_bug.cgi?id=1919066
https://github.com/istio/istio/compare/1.4.2...1.5.0-alpha.0

Get alerted when CVE-2019-25014 or the next vulnerability affects your stack