 cases, new releases will not typically be released just to resolve these CVEs, and the fixes will be included in the next regularly scheduled release.</p><p>As a result, base image CVEs should not be <a href=/v1.20/docs/releases/security-vulnerabilities/#reporting-a-vulnerability>reported</a> unless there is evidence it may be exploitable within Istio.</p><p>The <a href=/v1.20/docs/ops/configuration/security/harden-docker-images/><code>distroless</code></a> base images are strongly encouraged if reducing b