{"id":"CVE-2021-39156","aliases":["GHSA-hqxw-mm44-gc4r"],"title":"Istio Fragments in Path May Lead to Authorization Policy Bypass","summary":"Istio Fragments in Path May Lead to Authorization Policy Bypass","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","vendor":"istio","product":"istio.io/istio","ecosystem":"go","affected":["istio.io/istio < 1.9.8","istio.io/istio >= 1.10.0, < 1.10.4","istio.io/istio >= 1.11.0, < 1.11.1"],"patched":["istio.io/istio 1.9.8","istio.io/istio 1.10.4","istio.io/istio 1.11.1"],"published":"2021-08-30","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hqxw-mm44-gc4r","references":[{"url":"https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39156"},{"url":"https://github.com/istio/istio"},{"url":"https://istio.io/latest/news/security/istio-security-2021-008"}],"tags":["osv","go","exploit-available"],"epss":0.01177,"epssPercentile":0.66254,"ingestedAt":"2026-07-09T18:56:36.565Z","exploits":{"github":1,"githubRepos":["https://github.com/mostafaanouarghorab/MicroserviceCVE-2021-39156"],"checkedAt":"2026-09-24T07:52:48.301Z"},"exploitAvailable":true,"slug":"CVE-2021-39156","body":"## Overview\n\n### Impact\nIstio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. \n\n### Patches\n* Istio 1.11.1 and above\n* Istio 1.10.4 and above\n* Istio 1.9.8 and above\n\n### Workarounds\nA Lua filter may be written to normalize the path.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.\n\n### References\nMore details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)\n\n### For more information\nIf you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com\n\n\n## Affected packages\n\n- `istio.io/istio < 1.9.8`\n- `istio.io/istio >= 1.10.0, < 1.10.4`\n- `istio.io/istio >= 1.11.0, < 1.11.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `istio.io/istio 1.9.8`\n- `istio.io/istio 1.10.4`\n- `istio.io/istio 1.11.1`","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4536,"id":"CVE-2021-39156","ts":1788887189176,"field":"exploit_available","old":"false","new":"true"},{"seq":3419,"id":"CVE-2021-39156","ts":1788886306467,"field":"exploit_available","old":"true","new":"false"},{"seq":2274,"id":"CVE-2021-39156","ts":1788882976218,"field":"exploit_available","old":"false","new":"true"},{"seq":1303,"id":"CVE-2021-39156","ts":1788882388132,"field":"exploit_available","old":"true","new":"false"},{"seq":417,"id":"CVE-2021-39156","ts":1788881823352,"field":"exploit_available","old":"false","new":"true"}]}