gular expressions in some of the Istio APIs: <code>JWT</code>, <code>VirtualService</code>, <code>HTTPAPISpecBinding</code>, <code>QuotaSpecBinding</code>.</li></ul><p><strong>ISTIO-SECURITY-2019-004</strong>: Envoy, and subsequently Istio are vulnerable to a series of trivial HTTP/2-based DoS attacks:</p><ul><li><strong><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512">CVE-2019-9512</a></strong>: HTTP/2 flood using <code>PING</code> frames and queuing of response <code>PING</code> ACK 