immediately to mitigate security risks arising from these vulnerabilities.</p><p>The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These
vulnerabilities impact Istio features that rely on Envoy to enforce any of authorization, routing, or rate limiting.</p><h2 id=affected-istio-releases>Affected Istio releases</h2><p>The following Istio releases are vulnerable:</p><ul><li><p>1.1, 1.1.1</p><ul><li>These releases can be 