1.x/announcing-1.1.2>Istio 1.1.2</a></p><p>For Istio 1.0.x deployments: update to a minimum of <a href=/v1.18/news/releases/1.0.x/announcing-1.0.7>Istio 1.0.7</a></p><p>While Envoy 1.9.1 requires opting in to path normalization to address CVE 2019-9901, the version of Envoy embedded in Istio 1.1.2 and 1.0.7 enables path
normalization by default.</p><h2 id=detection-of-nul-header-exploit>Detection of NUL header exploit</h2><p>Based on current information, this only affects HTTP/1.1 traffic. If this is not st