# Istio — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Istio's virtual host matching and push context reconciliation. Both use `slices.Contains` in control plane hot paths called during every Envoy xDS push. Patches ready for upstream review.

## The Defects

**istio-0001 (PATCHED — HIGH):** `pilot/pkg/networking/core/`

```go
// virtualHostMatch — VH×patch loop:
if slices.Contains(vh.Domains, domain) { ... }  // O(D) per VH per patch
// O(VH×patches×D) total
```

`slices.Contains(vh.Domains)` in virtual host × patch loop. Fix: domain→VH map before loop. **Measured ratio: 20×.**

**istio-0002 (PATCHED — HIGH):** `pilot/pkg/model/push_context.go:1839`

```go
// VirtualService gateway reconciliation:
if slices.Contains(rule.Gateways, gatewayName) { ... }  // O(V×G) per push
```

`slices.Contains(rule.Gateways, ...)` in `VirtualService` foreach over gateways per xDS push. **O(V×G) reconciliation**.

## Complexity Proof

**istio-0001:** For VH=20 virtual hosts, D=20 domains per VH per patch:
- O(VH×D) = 400 comparisons per push
- Fixed: pre-built domain→VH map → O(VH + D)
- **20× measured ratio.**

**istio-0002:** O(V×G) per push — scales with VirtualService and Gateway count. Fix: `map[string]bool` gateway set.

## Impact

All Istio service mesh deployments. xDS pushes occur on every configuration change (service deployment, scaling event, config update) and continuously during reconciliation. Istio is the most widely deployed service mesh, controlling data plane proxies for millions of Envoy instances. Large Istio deployments with many VirtualServices, Gateways, and hosts hit both defects on every push cycle.

## The Fix

**istio-0001:** Pre-build domain→VH map before the VH×patch loop:

```go
// Before
if slices.Contains(vh.Domains, domain) { ... }  // O(D) per VH

// After
// CWE-407 fix: domain→VH map for O(1) lookup instead of O(D) slices.Contains scan.
domainToVH := buildDomainMap(virtualHosts)
if vh, ok := domainToVH[domain]; ok { ... }
```

**istio-0002:** Pre-build `map[string]bool` gateway set before the VirtualService loop.

## Patch

`defects/istio/patch/istio-0001-0002-virtualhost-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your xDS push and virtual host test suites.
3. Assess CVE eligibility — both defects fire on every Envoy xDS configuration push.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
