---
id: CVE-2021-39156
aliases:
  - GHSA-hqxw-mm44-gc4r
title: Istio Fragments in Path May Lead to Authorization Policy Bypass
summary: Istio Fragments in Path May Lead to Authorization Policy Bypass
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
vendor: istio
product: istio.io/istio
ecosystem: go
affected:
  - istio.io/istio < 1.9.8
  - 'istio.io/istio >= 1.10.0, < 1.10.4'
  - 'istio.io/istio >= 1.11.0, < 1.11.1'
patched:
  - istio.io/istio 1.9.8
  - istio.io/istio 1.10.4
  - istio.io/istio 1.11.1
published: '2021-08-30'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hqxw-mm44-gc4r'
references:
  - url: 'https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-39156'
  - url: 'https://github.com/istio/istio'
  - url: 'https://istio.io/latest/news/security/istio-security-2021-008'
tags:
  - osv
  - go
  - exploit-available
epss: 0.01177
epssPercentile: 0.66266
ingestedAt: '2026-07-09T18:56:36.565Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mostafaanouarghorab/MicroserviceCVE-2021-39156'
  checkedAt: '2026-09-26T09:05:27.042Z'
exploitAvailable: true
---

## Overview

### Impact
Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. 

### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above

### Workarounds
A Lua filter may be written to normalize the path.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)

### For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com


## Affected packages

- `istio.io/istio < 1.9.8`
- `istio.io/istio >= 1.10.0, < 1.10.4`
- `istio.io/istio >= 1.11.0, < 1.11.1`

## Remediation

Upgrade to a patched release:

- `istio.io/istio 1.9.8`
- `istio.io/istio 1.10.4`
- `istio.io/istio 1.11.1`