<h2 id=impact-and-detection>Impact and detection</h2><p>Both Istio gateways and sidecars are vulnerable to this issue. If you are running one of the affected releases where downstream&rsquo;s requests are HTTP/2 while upstream&rsquo;s are HTTP/1, then your cluster is vulnerable. We expect this to be true of most clusters.</p><h2 id=mitigation>Mitigation</h2><ul><li>For Istio 1.2.x deployments: update to <a href=/v1.19/news/releases/1.2.x/announcing-1.2.10>Istio 1.2.10</a> or later.</li><li>For Istio 1.3.x d