RATATOSKRATATOSK
Sign in

Cilium

v1.20.1Networking & Messaging
Aug 18, 2026

CHECK 1OTHER 51

A maintenance release with numerous operator-facing bug fixes, behavior corrections, dependency and image updates, and a newly enforced decoder-memory limit. It also includes a fix for a CIDR policy bypass and traffic drops after agent restarts.

Check if affected (1)

  • securityThe endpoint CIDR policy enforcement, corrected

    Applies if endpoint functionality is in use after an agent restart.

    The endpoint handling fixes a silent CIDR policy bypass and traffic drops after an agent restart. This is the described security fix in endpoint processing.

All 51 other recorded changesfixes 29 · value changes 21 · constraints 1

fixes (29)

  • * azure: Stop issuing redundant CiliumNode status updates on every IPAM sync when the node's Azure interfaces are unchanged. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47449, @jaredledvina)
  • * bpf: dsr: don't look for TCP header on fragmented packets (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47640, @julianwiedmann)
  • * bpf: hostfw: tolerate unknown CT protocols and rely on policies (Backport PR cilium/cilium#47621, Upstream PR cilium/cilium#47343, @smagnani96)
  • * clustermesh: fix MCS-API CRD install/upgrade when clustermesh-apiserver is started before the CRD version is actually installed (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47824, @MrFreezeex)
  • * datapath: turn ARP off on the base devices before bringing them up (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47838, @aanm)
  • * endpoint/watchdog: Avoid warning about endpoints being deleted (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47625, @christarazi)
  • * envoy.httpUpstreamLingerTimeout accepts 0 as a chart value and templates into configmap. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47741, @jdw6359)
  • * envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47583, @aanm)
  • * Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47765, @julianwiedmann)
  • * Fix a deadlock in the shutdown of Cilium operator related to CiliumEndpointSlices. (Backport PR cilium/cilium#47967, Upstream PR cilium/cilium#47802, @bimmlerd)
  • * Fix a NetworkPolicy update being ignored for up to two minutes when it arrived while an endpoint was waiting for its security identity to be resolved after a pod relabel. (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47727, @aanm)
  • * Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47295, @aanm)
  • * Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47552, @haozhangami)
  • * Fix unintended RevDNAT for client-to-pod TCP connections, when an identical connection was previously established through a DSR Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47593, @julianwiedmann)
  • * fix: allow setting endpointPolicyUpdateTimeoutDuration in helm (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47754, @weizhoublue)
  • * Fixed an issue where an HTTPRoute referencing a Gateway with mixed listener protocols (e.g. HTTP and TCP) was incorrectly rejected with NotAllowedByListeners when the TCP listener had an explicit AllowedRoutes.Kinds restriction. (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46842, @pidreher)
  • * gateway-api/gamma: refresh CEC owner refs on route recreation (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47840, @mhofstetter)
  • * gateway-api: mark unresolved backend service ports in route status (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47766, @mhofstetter)
  • * gateway-api: preserve duplicate HTTPRoute rule precedence (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46696, @thorn3r)
  • * gateway-api: prevent conflicted listeners from reaching ingestion (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47457, @asauber)
  • * gateway-api: requeue L4/TLS routes on ServiceImport updates (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47702, @mhofstetter)
  • * gateway-api: sync ListenerSet TLS secrets on ListenerSet events (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47627, @mhofstetter)
  • * ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47208, @iwanhae)
  • * l2announcer: re-evaluate services on frontend changes (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47579, @mhofstetter)
  • * Log the correct route kind when the Gateway API operator fails to list TLSRoutes for a backend Service (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47826, @mehrdadbn9)
  • * Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47844, @bimmlerd)
  • * standalone-dns-proxy: return an error when no endpoint is found (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47791, @vipul-21)
  • * wireguard: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47614, @HadrienPatte)
  • * Gateway API: the Gateway address status no longer reports a bogus "<nil>" address when a Node's first status address is not an IP literal (e.g. a Hostname entry). (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47466, @locker95)

value changes (21)

  • * envoy: demote stale ADS endpoint warning (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47148, @nezdolik)
  • * Speed up recovery time for disrupted TCP connections that access a DSR-enabled Service. (Backport PR cilium/cilium#47881, Upstream PR cilium/cilium#47529, @julianwiedmann)
  • * operator: Emit startup logs in the configured log format (Backport PR cilium/cilium#47954, Upstream PR cilium/cilium#47890, @HadrienPatte)
  • * chore(deps): update all-dependencies (v1.20) (cilium/cilium#47678, @cilium-renovate[bot])
  • * chore(deps): update dependency protocolbuffers/protobuf-go to v1.36.12 (v1.20) (cilium/cilium#47988, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 705e964 (v1.20) (cilium/cilium#47949, @cilium-renovate[bot])
  • * chore(deps): update docker.io/library/golang:1.26.5 docker digest to 7caba52 (v1.20) (cilium/cilium#47864, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786449955-8e46c97d1cecc0ba6af6c0c7018a8f18ec93e70d (v1.20) (cilium/cilium#47899, @cilium-renovate[bot])
  • * chore(deps): update quay.io/cilium/cilium-envoy docker tag to v1.37.5-1786810558-766ccfb37260a43e9d228837aa84ce3faf9f64e7 (v1.20) (cilium/cilium#47989, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47865, @cilium-renovate[bot])
  • * chore(deps): update stable lvh-images (v1.20) (patch) (cilium/cilium#47990, @cilium-renovate[bot])
  • * gateway-api: remove unnecessary TLSRoute support checks (Backport PR cilium/cilium#47885, Upstream PR cilium/cilium#47758, @mhofstetter)
  • * gateway-api: report invalid HTTPRoute header modifiers in status (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#47599, @mhofstetter)
  • * gateway-api: return route check errors directly (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47607, @mhofstetter)
  • * gateway-api: unify Gateway API listener parentRef matching (Backport PR cilium/cilium#47690, Upstream PR cilium/cilium#46670, @arybolovlev)
  • * gateway-api: validate gRPCRoute header modifiers in status (Backport PR cilium/cilium#47805, Upstream PR cilium/cilium#47606, @mhofstetter)
  • * Update docker.io/library/busybox:1.38.0 Docker digest to dc2d74b (v1.20) (cilium/cilium#47655, @cilium-renovate[bot])
  • * Update quay.io/cilium/certgen Docker tag to v0.4.9 (v1.20) (cilium/cilium#47657, @cilium-renovate[bot])
  • * Update quay.io/cilium/image-tester Docker tag to v1785158849 (v1.20) (cilium/cilium#47659, @cilium-renovate[bot])
  • * Update quay.io/lvh-images/kind Docker tag to v6.18-20260720.023802 (v1.20) (cilium/cilium#47658, @cilium-renovate[bot])
  • * install: Update image digests for v1.20.0 (cilium/cilium#47584, @cilium-release-bot[bot])

constraints (1)

  • * clustermesh/endpointslices: explicitly limit maximum decoder memory (Backport PR cilium/cilium#47962, Upstream PR cilium/cilium#47932, @giorio94)
Add Cilium to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Cilium releases →