them. If prefix path matching rules are used by Mixer or by Istio authorization
policies or the routing rules, an attacker could exploit these vulnerabilities to gain access to unauthorized paths on certain HTTP backends.</p><h2 id=mitigation>Mitigation</h2><p>Eliminating the vulnerabilities requires updating to a corrected version of Envoy. We’ve incorporated the necessary updates in the latest Istio patch releases.</p><p>For Istio 1.1.x deployments: update to a minimum of <a href=/v1.18/news/releases/1.