Cilium

v1.19.8Networking & Messaging

Sep 16, 2026

A maintenance release focused on correctness fixes and dependency updates, with a small number of new extension points. It does not introduce broad operator-facing configuration changes.

Action needed (1)

breakingRemoval of the Ingress HostFW Policy between RevSNAT and RevDNAT
The BPF NodePort path removes the Ingress HostFW Policy between RevSNAT and RevDNAT.

All 49 other recorded changesvalue changes 31 · fixes 16 · additions 2

value changes (31)

* chore(deps): update all external docker images dependencies to v0.13.6 (v1.19)
* chore(deps): update all github action dependencies (v1.19)×3
* chore(deps): update all-dependencies (v1.19)×3
* chore(deps): update base-images (v1.19)
* chore(deps): update base-images to v1.26.8 (v1.19)
* chore(deps): update dependency cilium/cilium-cli to v0.20.0 (v1.19)
* chore(deps): update dependency go to v1.25.14 (v1.19)
* chore(deps): update dependency protocolbuffers/protobuf to v36 (v1.19)
* chore(deps): update dependency protocolbuffers/protobuf to v36.1 (v1.19)
* chore(deps): update docker/setup-qemu-action action to v4.3.0 (v1.19)
* chore(deps): update golangci/golangci-lint docker tag to v2.13.2 (v1.19)
* chore(deps): update google/cloud-sdk docker tag to v581 (v1.19)
* chore(deps): update helm/kind-action action to v1.15.0 (v1.19)
* chore(deps): update quay.io/cilium/certgen docker tag to v0.4.11 (v1.19)
* chore(deps): update quay.io/cilium/cilium-envoy docker tag to … (…)×3
* chore(deps): update stable lvh-images (v1.19) (patch)×4
* fix(deps): update k8s.io patch updates stable to v0.35.8 (v1.19)
* fix(deps): update module k8s.io/apimachinery to v0.35.8 (v1.19)
* Fixes: Update node-cache image version to 1.26.5
* vendor: Bump StateDB to v0.5.10
* install: Update image digests for v1.19.7
* proxy: Bump envoy to v1.37.x

fixes (16)

* aws/ipam: Fixed a bug where the operator would fail to allocate new IPs to nodes with prefix delegation enabled on subnets that ran out of prefixes.
* bpf: Fix agent crash when dumping map events
* bpf: hostfw: tolerate unknown CT protocols and rely on policies
* datapath/linux/config: fix IPV4_DIRECT_ROUTING selection on lo device
* Fix Hubble Relay remains running during termination
* Fix missing config setup for 'enable-non-default-deny-policies' flag
* Fix nodeport egress tuple reuse for closed connections
* Fix restored ENI endpoints routing rule configuration when masquerading config changes
* fix(socketlb): only detach Cilium-owned cgroup programs
* Fixed a bug that caused the clustermesh-apiserver etcd users managements logic to not revoke stale roles upon configuration change; users leveraging the configuration provided by the Cilium helm chart are not affected, as the target etcd role is never changed.
* Fixed five configuration options that were accepted but silently ignored: vtep-sync-interval, enable-xt-socket-fallback, eni-delete-on-termination with a custom CNI configuration, the enableIdentityMark Helm value outside CNI chaining mode, and lb-retry-backoff-max.
* hubble: fix four config knobs that never reach their sink
* operator: Emit startup logs in the configured log format
* standalone-dns-proxy: return an error when no endpoint is found
* Strengthen the validation when ingesting service backends from Cluster Mesh to prevent issues in case of specially crafted values
* Fix verifier error "detect support for FnSetRetval for program type CGroupSock" during feature probing

additions (2)

* Add extension points for cilium-envoy Daemonset readiness, liveness and startup probes
* helm: add general busybox image values for substitution

Add Cilium to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →

Official release note ↗All Cilium releases →