RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Ciliumv1.18.13Networking & MessagingAug 18, 2026
ACTION 1OTHER 26View full analysis

A maintenance release that adds host-firewall protocol support, corrects networking and stability defects, and changes runtime behavior and observability. It also updates dependencies and container images, including a gRPC security fix with no disclosed vulnerability.

Action needed (1)

  • securityThe google.golang.org/grpc dependency, updated to v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 in the v1.18 release line. The release note marks this dependency update as a security fix, but does not disclose the vulnerability.

Source ↗
Contourv1.33.6Networking & MessagingAug 12, 2026
ACTION 1CHECK 1OTHER 3View full analysis

A maintenance release with a security fix for an external authorization bypass and dependency updates for CVE fixes. It also updates the tested Kubernetes range to 1.32 through 1.34, Go to 1.25.12, and Envoy to v1.38.3.

Action needed (1)

  • securityDependency updates for CVE fixes

    Dependencies were updated to fix CVEs. The updates ship in Contour v1.33.6.

Check if affected (1)

  • securityExternal authorization bypass with disabled authPolicy

    Applies if authPolicy is not configured.

Source ↗
Ciliumv1.20.0Networking & MessagingJul 29, 2026
ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

  • securitygoogle.golang.org/grpc v1.79.3

    The google.golang.org/grpc module is updated to v1.79.3 in the main branch.

  • securitygoogle.golang.org/grpc v1.82.1

    The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.

  • securityhelm.sh/helm/v4 v4.1.4

    The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.

  • securitygithub.com/cloudflare/circl v1.6.3

    The github.com/cloudflare/circl module is updated to v1.6.3.

  • securitygithub.com/go-jose/go-jose/v4 v4.1.4

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.

  • securitygithub.com/moby/spdystream v0.5.1

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingcni.customConf CNI configuration version

    The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.

  • breakingCilium operator IPAM metrics removal

    The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.

  • breakingDefault CNI configuration version

    The default CNI configuration version changes from 0.3.1 to 1.0.0.

  • breakingNative histogram default

    Native histograms are emitted for all histograms by default.

  • breakingAgent bootstrap metrics removal

    Agent bootstrap metrics are removed.

Check if affected (28)

  • securitytbid traffic host namespace handling

    Applies if you use tbid traffic.

  • breakingDocker libnetwork plugin removal

    Applies if you use the Docker libnetwork plugin.

  • breakingces-slice-mode removal

    Applies if you configure ces-slice-mode.

  • + 25 more on the release page

Plan ahead (6)

  • deprecatedBeta Mutual Auth deprecationremoval date not announced

    Applies if you use Mutual Auth.

  • deprecatedDeprecated address and interface CIDR fields

    Applies if you configure addresses[].subnet or interfaces[].cidr.

  • deprecatedLocal REST BGP API deprecationremoval date not announced

    Applies if you use the local REST BGP APIs.

  • + 3 more on the release page
Source ↗
Istio1.28.9Networking & MessagingJun 24, 2026
ACTION 7CHECK 7View full analysis

A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.

Action needed (7)

  • securityhighCVE-2026-48044, Zstd decompressor ratio enforcement

    CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.

  • securitymediumCVE-2026-47692, PROXY protocol TLV length validation

    CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.

  • securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling

    CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.

  • securitymediumCVE-2026-48090, asynchronous token callback lifetime

    CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.

  • securitymediumCVE-2026-47778, peer certificate SAN validation

    CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.

  • securitymediumCVE-2026-48497, query name length checking

    CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.

  • securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix

    GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.

Check if affected (7)

  • securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation

    Applies if you enable envoy.reloadable_features.quic_validate_headers_only_content_length.

  • securityhighCVE-2026-48042, JSON parser nesting depth limit

    Applies if you set envoy.reloadable_features.limit_json_parser_nesting_depth to false.

  • securitymediumCVE-2026-47207, ext_proc server response handling

    Applies if you use the ext_proc server.

  • + 4 more on the release page
Source ↗
Istio1.29.5Networking & MessagingJun 24, 2026
ACTION 4CHECK 11OTHER 5View full analysis

A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.

Action needed (4)

  • securitymediumCVE-2026-47221 in HTTP 303 internal redirects

    CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.

  • securitymediumCVE-2026-48090 in asynchronous token change callbacks

    CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.

  • securitymediumCVE-2026-47778 in peer certificate SAN validation

    CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.

  • securitymediumCVE-2026-48497 query name length checking

    CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.

Check if affected (11)

  • securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter

    Applies if you configure the %REQUESTED_SERVER_NAME% formatter.

  • securityhighCVE-2026-48044 in the Zstd decompressor

    Applies if you use the Zstd decompressor.

  • securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation

    Applies if you use HTTP/3 and enable envoy.reloadable_features.quic_validate_headers_only_content_length.

  • + 8 more on the release page
Source ↗
Istio1.30.2Networking & MessagingJun 24, 2026
ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

  • securityhighCVE-2026-47220 crash bug fix

    The Envoy security update fixes the crash bug described by CVE-2026-47220.

  • securityhighCVE-2026-48044 memory exhaustion fix

    The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.

  • securityhighCVE-2026-48042 JSON nesting-depth limit

    The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.

  • securitymediumCVE-2026-47692 bug fix

    The Envoy security update fixes the bug described by CVE-2026-47692.

  • securitymediumCVE-2026-47205 use-after-free crash fix

    The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.

  • securitymediumCVE-2026-48090 asynchronous token callback handling

    The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.

  • securitymediumCVE-2026-47778 Subject Alternative Name validation

    The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).

  • securitymediumCVE-2026-47204 crash and use-after-free fix

    The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.

  • securitymediumCVE-2026-48497 query name length checking

    The Envoy security update fixes sanity checking of the query name length.

  • securitymediumCVE-2026-47775 padding oracle

    The Envoy security update addresses a padding oracle described by CVE-2026-47775.

  • securityGHSA-p7c7-7c47-pwch denial-of-service fix

    The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.

  • breakingWarn-level message logging

    The message is now logged at warn level.

Check if affected (5)

Source ↗
Envoyv1.38.3Networking & MessagingJun 23, 2026
ACTION 16CHECK 2View full analysis

A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.

Action needed (16)

  • securityhighThe com_github_wasmtime dependency update

    The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.

  • securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220

    The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.

  • securityhighzstd RLE zip bomb, CVE-2026-48044

    The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

  • securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042

    The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

  • securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743

    The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.

  • securitymediumAuthz per route crash, CVE-2026-47205

    The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.

  • securitymediumThe ext_proc response issue, CVE-2026-47207

    The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.

  • securitymediumRouter internal redirects crash, CVE-2026-47221

    The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.

  • securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775

    The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.

  • securitymediumThe grpc_stats filter segfault, CVE-2026-47204

    The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.

  • securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692

    The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.

  • securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778

    The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.

  • securitymediumOAuth2 filter late token completion, CVE-2026-48090

    The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.

  • securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497

    The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.

  • securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706

    The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.

  • securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch

    The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.

Check if affected (2)

  • breakingThe envoy.network.connection_balance.dlb extension removal

    Applies if you use envoy.network.connection_balance.dlb.

  • breakingThe envoy.reloadable_features.tls_certificate_compression_brotli default

    Applies if you do not configure envoy.reloadable_features.tls_certificate_compression_brotli.

Source ↗
Envoyv1.37.5Networking & MessagingJun 23, 2026
ACTION 1CHECK 16View full analysis

A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy.network.connection_balance.dlb contrib extension at the Bazel layer for all builds and platforms.

Action needed (1)

  • securityhighcom_github_wasmtime dependency update, CVE-2026-47261

    The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Check if affected (16)

Source ↗
Envoyv1.36.9Networking & MessagingJun 23, 2026
ACTION 1CHECK 15View full analysis

A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy.network.connection_balance.dlb is disabled in all builds.

Action needed (1)

  • securityhighHighly nested JSON destructor stack overflow

    The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (15)

  • securityhighzstd RLE zip bomb correction

    Applies if you use zstd.

  • securityhighHTTP/3 to HTTP/1 request smuggling

    Applies if you use HTTP/3 and HTTP/1.

  • securityhighcom_github_wasmtime dependency update

    Applies if you use wasm.

  • + 12 more on the release page
Source ↗
Envoyv1.35.13Networking & MessagingJun 23, 2026
ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

  • securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042

    This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

Source ↗
Strimzi1.0.1Networking & MessagingJun 17, 2026
ACTION 2CHECK 2View full analysis

A release focused on CRD compatibility and Entity Operator watching defaults, with fixes for disclosed security vulnerabilities. It affects deployments using older CRD APIs or configuring cross-namespace watching.

Action needed (2)

Check if affected (2)

  • breakingSupported CRD API versions narrowed

    Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.

  • breakingEntity Operator cross-namespace watching default

    Applies if you configure STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED or watchedNamespace.

Source ↗
Istio1.29.4Networking & MessagingJun 4, 2026
ACTION 1OTHER 6View full analysis

A maintenance release with a security fix for Envoy and operator-relevant correctness fixes across Istio ambient, gateway, routing, and CNI behavior. It also adds automatic fallback from the nftables backend to iptables when the bundled nft binary lacks JSON support.

Action needed (1)

  • securityhighCVE-2026-47774 Envoy memory exhaustion fix

    CVE-2026-47774 fixes an Envoy memory exhaustion issue in which specially crafted HTTP/2 requests could bypass request header size accounting and trigger excessive memory use. The fix ships in Envoy.

Source ↗
Istio1.28.8Networking & MessagingJun 4, 2026
ACTION 1OTHER 3View full analysis

A maintenance release with a disclosed Envoy denial-of-service fix and additional correctness fixes. The security fix addresses memory exhaustion from specially crafted HTTP/2 requests, while the other corrections do not require setup changes.

Action needed (1)

  • securityhighThe Envoy denial-of-service vulnerability CVE-2026-47774, fixed

    CVE-2026-47774 fixes an Envoy denial-of-service vulnerability in which specially crafted HTTP/2 requests could cause excessive memory consumption. The fix accounts for cookie header bytes during request header size validation and limits total decoded header size in HPACK processing.

Source ↗
Istio1.30.1Networking & MessagingJun 4, 2026
ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

  • securityhighCVE-2026-47774 Envoy denial-of-service fix

    The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

  • breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet

    Applies if you use the ListenerSet API.

Source ↗
Envoyv1.38.1Networking & MessagingJun 4, 2026
ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

  • securityhighnghttp2 patch for CVE-2026-27135

    The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

  • securityhighHTTP/2 header-limit enforcement and cookie accounting

    Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.

  • securityOAuth2 HMAC verification timing side-channel fix

    Applies if you use oauth2.

  • breakingRouter transport-failure reason response body

    Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.

  • + 1 more on the release page
Source ↗
Envoyv1.37.3Networking & MessagingJun 4, 2026
ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

  • securityhighnghttp2 CVE-2026-27135 patch

    The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

  • securityhighHTTP/2 header list limits and cookie accounting

    Applies if you use HTTP/2.

  • securityOAuth2 HMAC verification timing

    Applies if you use oauth2.

Source ↗
Envoyv1.36.7Networking & MessagingJun 4, 2026
ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

  • securityhighThe nghttp2 CVE-2026-27135 patch

    Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

  • securityhighHTTP/2 header-limit enforcement and cookie accounting

    Applies if you use HTTP/2 with configured header list or request-header limits.

  • securityOAuth2 HMAC verification timing side-channel fix

    Applies if you use the OAuth2 filter.

Source ↗
Envoyv1.35.11Networking & MessagingJun 3, 2026
ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

  • securityhighThe nghttp2 CVE-2026-27135 patch

    Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

  • securityhighHTTP/2 header limits and cookie accounting

    Applies if you use HTTP/2 request header limits.

  • securityOAuth2 HMAC verification timing protection

    Applies if you use OAuth2 HMAC verification.

Source ↗
Contourv1.33.5Networking & MessagingMay 28, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for invalid HTTPProxy configurations and an update to golang.org/x/net. It also updates the Go toolchain to 1.25.10 and is tested against Kubernetes 1.32 through 1.34.

Action needed (1)

  • securitycriticalgolang.org/x/net updated to v0.55.0, CVE-2026-39821

    Contour v1.33.5 updates golang.org/x/net to v0.55.0. The change addresses CVE-2026-39821.

Check if affected (1)

  • securitymediumInvalid HTTPProxy configuration rejected, GHSA-g3xr-5w5j-w4q4

    Applies if you configure HTTPProxy with a fallback certificate and enable JWT verification.

Source ↗
Istio1.29.3Networking & MessagingMay 18, 2026
ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

  • securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump

    Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

  • securityRegex handling in AuthorizationPolicy identity fields

    Applicability is not stated in the release notes.

  • breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes

    Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).

Source ↗
Istio1.28.7Networking & MessagingMay 18, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.

Action needed (1)

  • securitySame-namespace authorization for StatusGen XDS debug endpoints

    The StatusGen-served XDS debug endpoints istio.io/debug/syncz and istio.io/debug/config_dump now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.

Check if affected (1)

  • securityEscaped regex metacharacters in AuthorizationPolicy identity fields

    Applies if you configure source.principals or source.namespaces.

Source ↗
Linkerdedge-26.5.2Networking & MessagingMay 15, 2026
ACTION 2OTHER 32View full analysis

A release that changes the default sidecar mode and promotes native sidecars to GA. It also fixes correctness issues, adds configurable timestamp handling, addresses eleven disclosed CVEs, and updates numerous dependencies.

Action needed (2)

Source ↗
Ciliumv1.19.4Networking & MessagingMay 13, 2026
ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

  • securityThe github.com/moby/spdystream module update

    The github.com/moby/spdystream module is updated to v0.5.1.

  • breakingService-label filtering for EndpointSlice watches

    The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

  • breakingLabel filtering for EndpointSlices

    Applies if you set --k8s-service-proxy-name.

Source ↗
Ciliumv1.17.16Networking & MessagingMay 13, 2026
ACTION 1CHECK 1OTHER 23View full analysis

A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.

Action needed (1)

  • securityThe github.com/moby/spdystream dependency update

    The github.com/moby/spdystream module is updated to v0.5.1 in v1.17.16.

Check if affected (1)

  • breakingCiliumLocalRedirectPolicy addressMatcher override behavior

    Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.

Source ↗
Ciliumv1.18.10Networking & MessagingMay 13, 2026
ACTION 1OTHER 29View full analysis

Cilium v1.18.10 contains correctness fixes, Helm support for overriding images, and dependency and image updates. The github.com/moby/spdystream update is marked as a security update, but no advisory identifier is provided.

Action needed (1)

  • securityThe github.com/moby/spdystream module update to v0.5.1

    Cilium v1.18.10 updates the github.com/moby/spdystream module to v0.5.1 as an undisclosed security update.

Source ↗
NATSv2.12.8Networking & MessagingApr 27, 2026
ACTION 1OTHER 22View full analysis

A maintenance release with a security fix, correctness fixes, a performance improvement, and dependency and toolchain manifest updates. Most changes take effect through the release itself without additional operator action.

Action needed (1)

  • securityBearer JWT disclosure fix in /connz

    The /connz monitoring endpoint no longer discloses bearer JWTs. The fix ships in the NATS monitoring endpoint.

Source ↗
Envoyv1.38.0Networking & MessagingApr 23, 2026
ACTION 1CHECK 6PLAN 1OTHER 77View full analysis

A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.

Action needed (1)

  • securityhighnghttp2 **CVE-2026-27135** patch

    The nghttp2 **CVE-2026-27135** patch is included.

Check if affected (6)

  • securityURL encoding for query_parameter_mutations values

    Applies if you configure query_parameter_mutations.

  • securityRBAC concatenation-based bypass prevention

    Applies if RBAC runs.

  • breakingExplicit max_early_data_bytes configuration

    Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.

  • + 3 more on the release page

Plan ahead (1)

  • deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced

    Applies if you configure enforce_rsa_key_usage.

Source ↗
Contourv1.32.5Networking & MessagingApr 20, 2026
ACTION 1OTHER 1View full analysis

Contour v1.32.5 fixes a Lua code injection vulnerability and upgrades Envoy to v1.34.14. The release also includes an informational Kubernetes compatibility update.

Action needed (1)

  • securityhighCVE-2026-41246 Lua code injection vulnerability fixed

    This release fixes CVE-2026-41246 and GHSA-x4mj-7f9g-29h4, a Lua code injection vulnerability affecting cookieRewritePolicies[].pathRewrite.value.

Source ↗
Ciliumv1.19.3Networking & MessagingApr 15, 2026
ACTION 1OTHER 50View full analysis

Cilium v1.19.3 combines operator-relevant bug fixes with configuration and CLI additions, along with dependency and image updates. The release is relevant to deployments using the affected functionality and to users tracking dependency changes.

Action needed (1)

  • securityThe github.com/go-jose/go-jose/v4 module update

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in the v1.19.3 release. The update is marked as security-related.

Source ↗
Ciliumv1.18.9Networking & MessagingApr 15, 2026
ACTION 2OTHER 39View full analysis

Cilium v1.18.9 contains correctness fixes and dependency updates. It also includes security-related changes, including an injection-prevention fix and a security-tagged module update.

Action needed (2)

  • securityRegex dollar-sign escaping for injection prevention

    Regex handling now escapes the $ character to prevent injection. The fix ships in Cilium v1.18.9.

  • securityThe github.com/go-jose/go-jose/v4 dependency update

    The github.com/go-jose/go-jose/v4 module is updated to v4.1.4 in Cilium v1.18.9. The release note marks this dependency update as security-related.

Source ↗
Emissary-Ingressv4.0.1Networking & MessagingMar 26, 2026
ACTION 1CHECK 6OTHER 14View full analysis

A release with operator-facing compatibility changes, including feature removals, aligned chart and application versions, GHCR-only chart distribution, and a changed CRD conversion-webhook default. It also updates dependencies and the Python interpreter to resolve CVEs, with additional defect fixes and new service and architecture capabilities.

Action needed (1)

  • securityDependency and Python interpreter updates for CVE fixes

    Many dependencies and the Python interpreter were updated to resolve CVEs.

Check if affected (6)

  • breakingCustom error responses and header-case mangling, removed

    Applies if you use Ambassador Edge Stack's custom error responses or header-case mangling features.

  • breakingHelm chart and Emissary version alignment

    Applies if you use the Helm chart.

  • breakingGHCR-only Helm chart distribution

    Applies if you use Emissary's Helm charts.

  • + 3 more on the release page
Source ↗
Contourv1.33.3Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with security-related dependency updates and removal of the hostPort setting from example manifests. It also documents compatibility testing with Kubernetes 1.32 through 1.34.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc v1.79.3 update

    google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected by this advisory.

  • securityEnvoy v1.35.9 update

    The Envoy dependency is updated to v1.35.9 to address security vulnerabilities.

Check if affected (1)

  • breakingRemoval of hostPort: 8002 from example manifests

    Applies if you use hostPort in example manifests.

Source ↗
Contourv1.32.4Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3

    google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

  • breakinghostPort: 8002 removed from example manifests

    Applies if hostPort: 8002 is configured in example manifests.

Source ↗
Contourv1.31.5Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186

    The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    The release bumps Envoy to v1.34.13.

Check if affected (1)

  • breakingEnvoy metrics hostPort: 8002 removed from example manifests

    Applies if example manifests use hostPort: 8002.

Source ↗
Strimzi0.45.2Networking & MessagingMar 12, 2026
ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

  • securityhighGRPC Netty Shaded update for CVE-2025-55163

    GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.

  • securitymediumZookeeper update for CVE-2024-47554

    The Zookeeper dependency was upgraded to remediate CVE-2024-47554.

  • securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864

    Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.

  • securitymediumNetty 4.1.130.Final update for CVE-2025-67735

    Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.

  • securitymediumApache Log4J 2.25.3 update for CVE-2025-68161

    Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.

  • securitymediumVertx 4.5.24 update for CVE-2026-1002

    Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.

  • securitymediumJackson update for GHSA-72hv-8253-57qq

    Jackson was updated to address GHSA-72hv-8253-57qq.

  • securityVert.x and Netty dependency updates

    The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

  • breakingKubernetes support narrowed to 1.25 and newer

    Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

  • breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46

    Applies if you use the Strimzi MirrorMaker 2 Extensions.

  • breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46

    Applies if you use the Strimzi EnvVar Configuration Provider.

  • deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46

    Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Source ↗
Envoyv1.37.1Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()

    The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix

    The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset

    HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

Source ↗
Envoyv1.36.5Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 json null terminator write fix

    Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 HTTP decoder reset handling

    Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

  • securityhighCVE-2026-26308 rbac multivalue header bypass fix

    Applies if you use rbac.

  • securitymediumCVE-2026-26330 ratelimit response phase limit crash fix

    Applies if you use ratelimit.

Source ↗
Envoyv1.35.9Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

Envoy v1.35.9 is a maintenance release with security fixes in RBAC, network address handling, JSON processing, and HTTP downstream reset handling. It also includes an ordinary defect correction and an updated Docker base-image dependency.

Action needed (4)

  • securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5, multivalue header bypass in RBAC

    Envoy v1.35.9 fixes CVE-2026-26308 and GHSA-ghc4-35x6-crw5, addressing a multivalue header bypass in RBAC.

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p, scoped IPv6 address crash

    Envoy v1.35.9 fixes CVE-2026-26310 and GHSA-3cw6-2j68-868p, preventing a crash in getAddressWithPort() when it receives a scoped IPv6 address.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943, JSON null-terminator write

    Envoy v1.35.9 fixes CVE-2026-26309 and GHSA-56cj-wgg3-x943, correcting an off-by-one write that could corrupt the string null terminator in JSON handling.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px, HTTP decode methods after downstream reset

    Envoy v1.35.9 fixes CVE-2026-26311 and GHSA-84xm-r438-86px, ensuring that decode* methods are blocked after a downstream reset in HTTP handling.

Source ↗
Envoyv1.34.13Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

A release with disclosed security fixes in RBAC, network handling, JSON processing, and HTTP decoding, plus an OAuth2 correctness fix and updated Docker base images. Upgrading addresses the security vulnerabilities, while the other fixes require no operator action.

Action needed (4)

  • securityhighCVE-2026-26308 multivalue header bypass in rbac

    CVE-2026-26308 (GHSA-ghc4-35x6-crw5) fixes a multivalue header bypass in rbac. The fix ships in this Envoy release.

  • securitymediumCVE-2026-26310 crash in getAddressWithPort()

    CVE-2026-26310 (GHSA-3cw6-2j68-868p) fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The fix ships in the Envoy network code.

  • securitymediumCVE-2026-26309 off-by-one write in json processing

    CVE-2026-26309 (GHSA-56cj-wgg3-x943) fixes an off-by-one write that could corrupt the string null terminator. The fix ships in the Envoy json code.

  • securitymediumCVE-2026-26311 blocking of decode* methods after downstream reset

    CVE-2026-26311 (GHSA-84xm-r438-86px) ensures that decode* methods are blocked after a downstream reset. The fix ships in the Envoy http code.

Source ↗
Istio1.29.1Networking & MessagingMar 10, 2026
ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

Source ↗
Older →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023