RATATOSKRATATOSK
Sign in

Cilium

v1.19.7Networking & Messaging
Aug 18, 2026

OTHER 45

A maintenance release with bug fixes, diagnostic improvements, dependency and image updates, and improved DNS request validation. It contains no security advisories or explicitly described vulnerabilities.

All 45 other recorded changesvalue changes 26 · fixes 14 · additions 4 · constraints 1

value changes (26)

  • chore(deps): update all github action dependencies (v1.19)×5
  • chore(deps): update all-dependencies (v1.19)
  • chore(deps): update base-images (v1.19)×2
  • chore(deps): update dependency cilium/cilium-cli to … (…)×2
  • chore(deps): update docker.io/library/golang:… docker digest to … (…)×2
  • chore(deps): update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (v1.19)
  • chore(deps): update github/codeql-action action to v4.37.2 (v1.19)
  • chore(deps): update google/cloud-sdk docker tag to v577 (v1.19)
  • chore(deps): update module sigs.k8s.io/kube-api-linter to v0.0.0-20260716143926-092fe0c72997 (v1.19)
  • chore(deps): update quay.io/cilium/certgen docker tag to v0.4.8 (v1.19)
  • chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×2
  • chore(deps): update stable lvh-images (v1.19) (patch)×3
  • fix(deps): update k8s.io patch updates stable to v0.35.7 (v1.19)
  • fix(deps): update module k8s.io/apimachinery to v0.35.7 (v1.19)
  • Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.19)
  • install: Update image digests for v1.19.6

fixes (14)

  • envoy: restore http-idle-timeout as the route idle timeout source
  • Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled.
  • Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules.
  • Fix abnormal ip allocation caused by hostnetwork pod
  • Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range.
  • Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy.
  • Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface.
  • Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts
  • fqdn/service: prune SDP identity->IP mapping on delete using newID
  • gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion.
  • ipcache: fix CIDR reference counter to use canonical prefixes
  • lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group.
  • Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled.
  • wireguard: Unsubscribe node handler on shutdown

additions (4)

  • Collect /proc/net/softnet_stat, /proc/net/snmp and /proc/net/netstat in sysdumps to help diagnose host-level packet drops.
  • bugtool: collect snmp6 and dev_snmp6 for IPv6 host packet drops
  • Update docker.io/library/busybox:1.37.0 Docker digest to 9db7b59 (v1.19)
  • [v1.19] Add DNS request checking prior to qname extraction

constraints (1)

  • Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK
Add Cilium to your stack

A weekly email arrives when a release needs action. Weeks with nothing to act on, like this one, send no email.

Add to stack →
Official release note ↗All Cilium releases →