CVE-2020-10739

Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.

• CWE-476
• CWE-476

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739Broken Link, Issue Tracking, Third Party Advisory
• https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633Patch, Third Party Advisory
• https://istio.io/news/security/istio-security-2020-005/Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739Broken Link, Issue Tracking, Third Party Advisory
• https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633Patch, Third Party Advisory
• https://istio.io/news/security/istio-security-2020-005/Mitigation, Vendor Advisory

Published

Jun 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10733The Windows installer for PostgreSQL 9.5 - 12 invokes system…7.3
• CVE-2020-10734A vulnerability was found in keycloak in the way that the OI…3.3
• CVE-2020-10735A flaw was found in python. In algorithms with quadratic tim…7.5
• CVE-2020-10736An authorization bypass vulnerability was found in Ceph vers…8
• CVE-2020-10737A race condition was found in the mkhomedir tool shipped wit…6.3
• CVE-2020-10738A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 be…8.8
• CVE-2020-1074<p>A remote code execution vulnerability exists when the Win…7.8
• CVE-2020-10740A vulnerability was found in Wildfly in versions before 20.0…7.5
• CVE-2020-10741Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-10742A flaw was found in the Linux kernel. An index buffer overfl…6
• CVE-2020-10743It was discovered that OpenShift Container Platform's (OCP) …4.3
• CVE-2020-10744An incomplete fix was found for the fix of the flaw CVE-2020…5