Istio — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Istio's virtual host matching and push context reconciliation. Both use slices.Contains in control plane hot paths called during every Envoy xDS push. Patches ready for upstream review.

The Defects

istio-0001 (PATCHED — HIGH): pilot/pkg/networking/core/

// virtualHostMatch — VH×patch loop:
if slices.Contains(vh.Domains, domain) { ... }  // O(D) per VH per patch
// O(VH×patches×D) total

slices.Contains(vh.Domains) in virtual host × patch loop. Fix: domain→VH map before loop. Measured ratio: 20×.

istio-0002 (PATCHED — HIGH): pilot/pkg/model/push_context.go:1839

// VirtualService gateway reconciliation:
if slices.Contains(rule.Gateways, gatewayName) { ... }  // O(V×G) per push

slices.Contains(rule.Gateways, ...) in VirtualService foreach over gateways per xDS push. O(V×G) reconciliation.

Complexity Proof

istio-0001: For VH=20 virtual hosts, D=20 domains per VH per patch:

O(VH×D) = 400 comparisons per push
Fixed: pre-built domain→VH map → O(VH + D)
20× measured ratio.

istio-0002: O(V×G) per push — scales with VirtualService and Gateway count. Fix: map[string]bool gateway set.

Impact

All Istio service mesh deployments. xDS pushes occur on every configuration change (service deployment, scaling event, config update) and continuously during reconciliation. Istio is the most widely deployed service mesh, controlling data plane proxies for millions of Envoy instances. Large Istio deployments with many VirtualServices, Gateways, and hosts hit both defects on every push cycle.

The Fix

istio-0001: Pre-build domain→VH map before the VH×patch loop:

// Before
if slices.Contains(vh.Domains, domain) { ... }  // O(D) per VH

// After
// CWE-407 fix: domain→VH map for O(1) lookup instead of O(D) slices.Contains scan.
domainToVH := buildDomainMap(virtualHosts)
if vh, ok := domainToVH[domain]; ok { ... }

istio-0002: Pre-build map[string]bool gateway set before the VirtualService loop.

Patch

defects/istio/patch/istio-0001-0002-virtualhost-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your xDS push and virtual host test suites.
Assess CVE eligibility — both defects fire on every Envoy xDS configuration push.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape