lletins/blob/master/advisories/third-party/2019-002.md>this security bulletin</a> for more information.</p><h2 id=impact-and-detection>Impact and detection</h2><p>If Istio terminates externally originated HTTP then it is vulnerable. If Istio is instead fronted by an intermediary that terminates HTTP (e.g., a HTTP load balancer), then that intermediary would protect Istio, assuming the intermediary is not itself vulnerable to the same HTTP/2 exploits.</p><h2 id=mitigation>Mitigation</h2><ul><li>For Istio 1.1