What’s Vulnerable › Vulnerabilities

CVE-2020-10739

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-02 · updated 2026-06-17
• Weakness: CWE-476

Description

Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.

Affected products

• istio: from 1.4.0 before 1.4.9; from 1.5.0 before 1.5.4 — fixed in 1.4.9, 1.5.4

How to fix

Upgrade to a fixed version: istio 1.4.9, 1.5.4. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739
• https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633
• https://istio.io/news/security/istio-security-2020-005/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739
• https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633
• https://istio.io/news/security/istio-security-2020-005/

Get alerted when CVE-2020-10739 or the next vulnerability affects your stack