RATATOSKRATATOSK
Sign in

Istio

1.29.7Networking & Messaging
Aug 27, 2026

ACTION 3CHECK 17OTHER 13

A security-focused maintenance release with fixes across Envoy and Istio, including authorization, request handling, and default behavior changes. It also contains correctness and performance fixes, an updated `nftables` version in Istio distroless images, and improvements for ambient and gateway operation.

Action needed (3)

  • securityURL normalization for parameterized dot path segments, fixed (CVE-2026-73551)

    This release fixes URL normalization for dot and dot-dot path segments with parameters. Advisory: CVE-2026-73551.

  • securityPath matching for per-segment parameters, fixed (CVE-2026-73511)

    This release fixes path matching for per-segment parameters. Advisory: CVE-2026-73511.

  • securityCross-user response poisoning on generic HTTP upgrades, fixed (CVE-2026-73548)

    This release fixes cross-user response poisoning on generic HTTP upgrades. Advisory: CVE-2026-73548.

Check if affected (17)

  • securityoghttp2 heap use-after-free, fixed (CVE-2026-73513)

    Applies if you use HTTP/2.

    This release fixes a heap use-after-free in oghttp2 when HTTP/2 trailers arrive without the END_STREAM flag. Advisory: CVE-2026-73513.

  • securitysafe_regex failure in negative-match RBAC policies, fixed (CVE-2026-73552)

    Applies if you use negative-match RBAC policies.

    This release fixes safe_regex failing open on non-UTF-8 header bytes in negative-match RBAC policies. Advisory: CVE-2026-73552.

  • securityQUIC HTTP datagram handler use-after-free, fixed (CVE-2026-73512)

    Applies if you use the QUIC HTTP datagram handler.

    This release fixes a use-after-free in the QUIC HTTP datagram handler. Advisory: CVE-2026-73512.

  • securityext_authz termination on CONNECT requests, fixed (CVE-2026-73547)

    Applies if you use ext_authz.

    This release fixes abnormal termination in ext_authz when CONNECT requests do not include a :path header. Advisory: CVE-2026-73547.

  • securityHTTP/3 termination for scoped IPv6 client addresses, fixed (CVE-2026-73549)

    Applies if you use HTTP/3.

    This release fixes abnormal termination for scoped IPv6 client addresses with HTTP/3. Advisory: CVE-2026-73549.

  • securityext_authz raw HTTP client use-after-free, fixed (CVE-2026-50572)

    Applies if you use the ext_authz raw HTTP client.

    This release fixes a use-after-free in the ext_authz raw HTTP client. Advisory: CVE-2026-50572.

  • securityStored cross-site scripting in the HTML stats interface, fixed (CVE-2026-73546)

    Applies if you use the HTML stats interface.

    This release fixes stored cross-site scripting in the HTML stats interface. Advisory: CVE-2026-73546.

  • securityHTTP/3 connection-pool selection null-pointer dereference, fixed (CVE-2026-48521)

    Applies if you use HTTP/3.

    This release fixes a null-pointer dereference during ALPN-based HTTP/3 connection-pool selection. Advisory: CVE-2026-48521.

  • securityHTTP/2 memory exhaustion through duplicate Host headers, fixed (CVE-2026-73550)

    Applies if you use HTTP/2.

    This release fixes HTTP/2 memory exhaustion through discarded duplicate Host headers. Advisory: CVE-2026-73550.

  • securityRBAC bypass through ignore_path_parameters_in_path_matching, fixed (CVE-2026-73553)

    Applies if you configure ignore_path_parameters_in_path_matching.

    This release fixes an RBAC bypass through ignore_path_parameters_in_path_matching. Advisory: CVE-2026-73553.

  • securityBackendTLSPolicy plaintext fallback with an unresolved CA reference (GHSA-qm8v-g4f9-qhjx)

    Applies if you configure BackendTLSPolicy, run sidecar proxies, and do not have a CA reference.

    This release fixes BackendTLSPolicy failing open to plaintext on sidecar proxies when its CA reference is unresolved. Advisory: GHSA-qm8v-g4f9-qhjx.

  • securityEnvoyFilter match expression length limit

    Applies if you configure EnvoyFilter with a match expression.

    The EnvoyFilter match expression is limited to 1024 characters in this release.

  • securityAuthorization policy enforcement on ingress gateways, fixed

    Applies if you run ingress gateways.

    This release fixes an issue causing authorization policies not to be enforced.

  • securityGateway API ResolvedRefs reference disclosure, fixed

    Applies if you use the Gateway API.

    This release fixes a Gateway API issue where a listener’s ResolvedRefs status could reveal whether a referenced Secret or ConfigMap existed when no grant permitted the reference.

  • securityistiod RequestAuthentication jwksUri SSRF gap, fixed

    Applies if istiod runs and you configure jwksUri.

    This release fixes an SSRF gap in istiod’s RequestAuthentication jwksUri fetching.

  • securityThe ENABLE_XDS_API_GENERATOR_AUTH default

    Applies if you do not configure ENABLE_XDS_API_GENERATOR_AUTH.

    ENABLE_XDS_API_GENERATOR_AUTH now defaults to true. This release supports ENABLE_XDS_API_GENERATOR_AUTH=false for compatibility.

  • securityOutput escaping for sidecar.istio.io/* injection annotations, fixed

    Applies if you configure any of proxyImage, bootstrapOverride, logLevel, componentLogLevel, or agentLogLevel.

    This release fixes output escaping for the proxyImage, bootstrapOverride, logLevel, componentLogLevel, and agentLogLevel sidecar.istio.io/* annotations when they are interpolated into sidecar and gateway injection templates.

All 13 other recorded changesfixes 11 · value changes 2

fixes (11)

  • Fixed a race condition on istiod startup where the readiness probe could report ready before the dedicated injection and validation webhook server ( --httpsAddr , default :15017 ) was accepting connections
  • Fixed an issue where gateway proxy Deployment resources could permanently fail to be created during istiod startup.
  • Fixed an issue where istio-cni considered hostNetwork pods eligible for ambient enrollment.
  • Fixed a file descriptor leak in the istio-cni node agent
  • Fixed a bug where the istio-cni node agent could pair an ambient pod with another pod’s network namespace
  • Fixed an issue where istiod permanently retained a copy of every workload resource name
  • Fixed a bug where a ztunnel reconnect (such as the periodic connection recycle from keepaliveMaxServerConnectionAge ) triggered a full workload (WDS) push.
  • Fixed goroutine and memory leaks in istiod in ambient multi-cluster mode when remote clusters are removed or updated.
  • Fixed a goroutine leak in istiod leader election where every election cycle (leadership lost and re-acquired) leaked one goroutine until process exit.
  • Fixed an issue where istiod CPU usage increased as the number of AuthorizationPolicy resources increased.
  • Fixed generated Gateway Service s being rejected when two listener names sanitize to the same Service port name

value changes (2)

  • Upgraded version of nftables used by Istio distroless images.
  • Improved performance when fetching PeerAuthentication resources for a given workload.
Add Istio to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Istio releases →