RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
Contourv1.32.4Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release with updated Envoy and gRPC dependencies, plus a change to the example manifests. It is tested against Kubernetes 1.31 through 1.33.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3

    google.golang.org/grpc is updated to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    Envoy is updated to v1.34.13 to address security vulnerabilities and improve stability.

Check if affected (1)

  • breakinghostPort: 8002 removed from example manifests

    Applies if hostPort: 8002 is configured in example manifests.

Source ↗
Contourv1.31.5Networking & MessagingMar 23, 2026
ACTION 2CHECK 1OTHER 1View full analysis

A maintenance release contains dependency security updates and an example-manifest cleanup. It also documents testing against Kubernetes 1.30 through 1.32.

Action needed (2)

  • securitycriticalgoogle.golang.org/grpc updated to v1.79.3 for CVE-2026-33186

    The release updates google.golang.org/grpc to v1.79.3, which addresses CVE-2026-33186 and GHSA-p77j-4mvh-x3m3. Contour is not affected.

  • securityEnvoy updated to v1.34.13

    The release bumps Envoy to v1.34.13.

Check if affected (1)

  • breakingEnvoy metrics hostPort: 8002 removed from example manifests

    Applies if example manifests use hostPort: 8002.

Source ↗
Strimzi0.45.2Networking & MessagingMar 12, 2026
ACTION 8CHECK 1PLAN 3OTHER 5View full analysis

A maintenance release that narrows Kubernetes support to version 1.25 and newer and marks several older Kafka and extension components for removal. It adds Kafka 3.9.2 support and includes dependency updates addressing multiple CVEs and a GHSA advisory.

Action needed (8)

  • securityhighGRPC Netty Shaded update for CVE-2025-55163

    GRPC Netty Shaded was upgraded to remediate CVE-2025-55163.

  • securitymediumZookeeper update for CVE-2024-47554

    The Zookeeper dependency was upgraded to remediate CVE-2024-47554.

  • securitymediumNimbus Jose JWT 10.0.2 update for CVE-2025-53864

    Nimbus Jose JWT was upgraded to version 10.0.2 to remediate CVE-2025-53864.

  • securitymediumNetty 4.1.130.Final update for CVE-2025-67735

    Netty was updated to version 4.1.130.Final to resolve CVE-2025-67735.

  • securitymediumApache Log4J 2.25.3 update for CVE-2025-68161

    Apache Log4J was updated to version 2.25.3 to remediate CVE-2025-68161.

  • securitymediumVertx 4.5.24 update for CVE-2026-1002

    Vertx was updated to version 4.5.24 to remediate CVE-2026-1002.

  • securitymediumJackson update for GHSA-72hv-8253-57qq

    Jackson was updated to address GHSA-72hv-8253-57qq.

  • securityVert.x and Netty dependency updates

    The Vert.x and Netty dependencies were bumped on the 0.45.x branch to fix CVEs.

Check if affected (1)

  • breakingKubernetes support narrowed to 1.25 and newer

    Applies if you use Kubernetes 1.23 or Kubernetes 1.24.

Plan ahead (3)

  • breakingStrimzi MirrorMaker 2 Extensions deprecationdeprecated since 0.28.0 · removal planned in 0.46

    Applies if you use the Strimzi MirrorMaker 2 Extensions.

  • breakingStrimzi EnvVar Configuration Provider inclusiondeprecated since 0.38.0 · removal planned in 0.46

    Applies if you use the Strimzi EnvVar Configuration Provider.

  • deprecatedZooKeeper-based Kafka and MirrorMaker 1 supportremoval planned in 0.46

    Applies if you use ZooKeeper-based Apache Kafka clusters or MirrorMaker 1 deployments.

Source ↗
Envoyv1.37.1Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()

    The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix

    The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset

    HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

Source ↗
Envoyv1.36.5Networking & MessagingMar 11, 2026
ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.

  • securitymediumCVE-2026-26309 json null terminator write fix

    Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.

  • securitymediumCVE-2026-26311 HTTP decoder reset handling

    Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

  • securityhighCVE-2026-26308 rbac multivalue header bypass fix

    Applies if you use rbac.

  • securitymediumCVE-2026-26330 ratelimit response phase limit crash fix

    Applies if you use ratelimit.

Source ↗
Envoyv1.35.9Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

Envoy v1.35.9 is a maintenance release with security fixes in RBAC, network address handling, JSON processing, and HTTP downstream reset handling. It also includes an ordinary defect correction and an updated Docker base-image dependency.

Action needed (4)

  • securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5, multivalue header bypass in RBAC

    Envoy v1.35.9 fixes CVE-2026-26308 and GHSA-ghc4-35x6-crw5, addressing a multivalue header bypass in RBAC.

  • securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p, scoped IPv6 address crash

    Envoy v1.35.9 fixes CVE-2026-26310 and GHSA-3cw6-2j68-868p, preventing a crash in getAddressWithPort() when it receives a scoped IPv6 address.

  • securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943, JSON null-terminator write

    Envoy v1.35.9 fixes CVE-2026-26309 and GHSA-56cj-wgg3-x943, correcting an off-by-one write that could corrupt the string null terminator in JSON handling.

  • securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px, HTTP decode methods after downstream reset

    Envoy v1.35.9 fixes CVE-2026-26311 and GHSA-84xm-r438-86px, ensuring that decode* methods are blocked after a downstream reset in HTTP handling.

Source ↗
Envoyv1.34.13Networking & MessagingMar 10, 2026
ACTION 4OTHER 2View full analysis

A release with disclosed security fixes in RBAC, network handling, JSON processing, and HTTP decoding, plus an OAuth2 correctness fix and updated Docker base images. Upgrading addresses the security vulnerabilities, while the other fixes require no operator action.

Action needed (4)

  • securityhighCVE-2026-26308 multivalue header bypass in rbac

    CVE-2026-26308 (GHSA-ghc4-35x6-crw5) fixes a multivalue header bypass in rbac. The fix ships in this Envoy release.

  • securitymediumCVE-2026-26310 crash in getAddressWithPort()

    CVE-2026-26310 (GHSA-3cw6-2j68-868p) fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The fix ships in the Envoy network code.

  • securitymediumCVE-2026-26309 off-by-one write in json processing

    CVE-2026-26309 (GHSA-56cj-wgg3-x943) fixes an off-by-one write that could corrupt the string null terminator. The fix ships in the Envoy json code.

  • securitymediumCVE-2026-26311 blocking of decode* methods after downstream reset

    CVE-2026-26311 (GHSA-84xm-r438-86px) ensures that decode* methods are blocked after a downstream reset. The fix ships in the Envoy http code.

Source ↗
Istio1.29.1Networking & MessagingMar 10, 2026
ACTION 1CHECK 10OTHER 9View full analysis

A maintenance release with multiple Envoy and Istio security fixes covering request handling, authorization, authentication, and plugin image fetching. It also includes ordinary correctness fixes and adds configuration for authorized namespaces on debug endpoints.

Action needed (1)

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes an off-by-one write in JSON handling.

Check if affected (10)

Source ↗
Istio1.28.5Networking & MessagingMar 10, 2026
ACTION 7CHECK 3OTHER 2View full analysis

A security-focused maintenance release with fixes for disclosed Envoy and Istio vulnerabilities, including authentication, authorization, parsing, and crash defects. It also adds namespace authorization for debug endpoints and fixes lost InferencePool configurations during VirtualService merging.

Action needed (7)

  • securityhighCVE-2026-26308 multivalue header bypass fix in RBAC

    CVE-2026-26308 fixes a multivalue header bypass in RBAC in Istio.

  • securityhighCVE-2026-31837 and GHSA-v75c-crr9-733c JWKS resolver authentication fix

    CVE-2026-31837 and GHSA-v75c-crr9-733c fix a JWKS resolver failure that may allow authentication bypass using known default keys.

  • securitymediumCVE-2026-26311 HTTP decode method fix

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset in Istio.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when processing a scoped IPv6 address in Istio.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write in Istio.

  • securitymediumCVE-2026-26330 ratelimit response phase crash fix

    CVE-2026-26330 fixes a crash in the ratelimit response phase in Istio.

  • securitymediumCVE-2026-31838 and GHSA-974c-2wxh-g4ww debug endpoint authorization fix

    CVE-2026-31838 and GHSA-974c-2wxh-g4ww address cross-namespace proxy data access through debug endpoints.

Check if affected (3)

  • securityAuthentication for XDS debug endpoints on port 15010

    Applies if you expose XDS debug endpoints.

  • securityBearer token realm URL validation for WasmPlugin image fetching

    Applies if you use WasmPlugin image fetching.

  • securityNamespace-based authorization for HTTP debug endpoints on port 15014

    Applies if you expose HTTP debug endpoints.

Source ↗
Istio1.27.8Networking & MessagingMar 10, 2026
ACTION 3CHECK 6OTHER 1View full analysis

A security-focused release with fixes across Envoy and Istio, including additional protections for debug endpoints, JWKS resolution, and WasmPlugin image fetching. The security fixes require an upgrade, while authorized namespace configuration for debug endpoints is optional.

Action needed (3)

  • securitymediumCVE-2026-26311 HTTP decode method correction

    CVE-2026-26311 blocks HTTP decode methods after a downstream reset.

  • securitymediumCVE-2026-26310 scoped IPv6 address crash fix

    CVE-2026-26310 fixes a crash in getAddressWithPort() when handling a scoped IPv6 address.

  • securitymediumCVE-2026-26309 JSON off-by-one write fix

    CVE-2026-26309 fixes a JSON off-by-one write.

Check if affected (6)

Source ↗
Strimzi0.51.0Networking & MessagingMar 6, 2026
ACTION 2CHECK 2PLAN 1OTHER 2View full analysis

A release with fixes for two disclosed security vulnerabilities, updated Kubernetes and Kafka support, and a changed feature-gate default. It also adds Kafka 4.2.0 support and per-listener Kafka options, while the ingress listener type is deprecated; CRD upgrades and a KafkaUser field migration are upgrade prerequisites.

Action needed (2)

  • securityhighCVE-2026-27133 and CVE-2026-27134 security fixes

    Security fixes in Strimzi 0.50.1 and 0.51.0 address CVE-2026-27133 and CVE-2026-27134, with advisories GHSA-2qwx-rq6j-8r6j and GHSA-6x85-j2f7-4xc5.

  • breakingThe ServerSideApplyPhase1 feature gate default

    The ServerSideApplyPhase1 feature gate moved to beta and is enabled by default.

Check if affected (2)

  • breakingKubernetes version support

    Applies if you use Kubernetes 1.27, 1.28, or 1.29.

  • breakingKafka 4.0.0 and 4.0.1 support

    Applies if you use Kafka 4.0.0 or 4.0.1.

Plan ahead (1)

  • deprecatedThe ingress listener type deprecation

    Applies if you configure the ingress listener type.

Source ↗
Strimzi0.50.1Networking & MessagingFeb 19, 2026
ACTION 1PLAN 1OTHER 12View full analysis

A maintenance release with two security fixes and a deprecated KafkaUser API field that requires migration. It also includes API conversion fixes, broker certificate output changes, and dependency and container image updates.

Action needed (1)

Plan ahead (1)

  • deprecatedThe .spec.authorization.acls[]operation field is deprecated

    Applies if you configure .spec.authorization.acls[]operation.

Source ↗
Istio1.28.4Networking & MessagingFeb 16, 2026
ACTION 1CHECK 4OTHER 7View full analysis

A maintenance release focused on security fixes, validation, and authorization changes across Istio control-plane and endpoint handling. It also includes operator-facing capability changes and corrections for other defects.

Action needed (1)

  • securityhighCVE-2025-61732 cgo comment parsing flaw

    This release fixes a discrepancy between Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Check if affected (4)

  • securitycriticalCVE-2025-68121 TLS session resumption validation

    Applies if you use Config.Clone with mutations or Config.GetConfigForClient.

  • securityGateway deployment controller resource validation

    Applies if the gateway deployment controller runs.

  • securityResource annotation validation against container injection

    Applies if you configure resource annotations.

  • + 1 more on the release page
Source ↗
Istio1.27.7Networking & MessagingFeb 16, 2026
ACTION 2View full analysis

A security release addressing two vulnerabilities in cgo comment parsing and crypto/tls session resumption. The fixes are relevant to deployments using the affected Go functionality.

Action needed (2)

  • securitycriticalCVE-2025-68121 session resumption vulnerability correction

    CVE-2025-68121 corrects a crypto/tls session resumption flaw that could let resumed handshakes succeed after ClientCAs or RootCAs changed between the initial and resumed handshake.

  • securityhighCVE-2025-61732 code-smuggling vulnerability correction

    CVE-2025-61732 addresses a discrepancy in Go and C/C++ comment parsing that allowed code smuggling into the resulting cgo binary.

Source ↗
Istio1.29.0Networking & MessagingFeb 16, 2026
ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

  • breakingAutomatic GOMEMLIMIT setting for istiod

    istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

  • breakingDefault iptables reconciliation

    Applies when the istio-cni DaemonSet is upgraded.

  • breakingDefault debug endpoint authorization

    Applies to debug endpoints on port 15014.

  • breakingDefault HTTP compression for Envoy metrics

    Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.

  • + 1 more on the release page
Source ↗
Ciliumv1.18.7Networking & MessagingFeb 13, 2026
ACTION 1OTHER 27View full analysis

A maintenance release combining an operator-facing configuration adjustment with bug fixes and routine dependency and image refreshes. No security advisories or security-specific fixes are disclosed.

Action needed (1)

  • breakingExclusion of topology.kubernetes.io labels from security labels by default

    The default security-label handling in this release excludes topology.kubernetes.io labels from security labels.

Source ↗
Istio1.27.6Networking & MessagingFeb 10, 2026
ACTION 1CHECK 2OTHER 2View full analysis

This release includes security safeguards for gateway resource creation and pod specification rendering, along with stricter authorization for debug endpoints. It also adds a Helm configuration field and corrects a TLS configuration mapping.

Action needed (1)

  • securityResource annotation validation

    Resource annotation validation now rejects newline and control characters that could inject containers into pod specifications through template rendering.

Check if affected (2)

  • securityGateway deployment controller resource validation

    Applies if the gateway deployment controller runs.

  • breakingNamespace-based authorization for debug endpoints

    Applies if you use debug endpoints on port 15014.

Source ↗
Ciliumv1.19.0Networking & MessagingFeb 4, 2026
ACTION 15CHECK 30PLAN 7OTHER 436View full analysis

A substantial operator-facing feature and maintenance release with new DNS proxy, installation, configuration, API, metric, and datapath capabilities. It also changes defaults and compatibility requirements, removes deprecated interfaces, migrates BGP APIs, and updates security-related dependencies.

Action needed (15)

  • securityThe github.com/containerd/containerd dependency, updated

    The github.com/containerd/containerd module is updated to v1.7.29.

  • securityThe github.com/go-viper/mapstructure/v2 dependency, updated

    The github.com/go-viper/mapstructure/v2 module is updated to v2.4.0.

  • securityThe github.com/docker/docker dependency, updated

    The github.com/docker/docker module is updated to v28.3.3+incompatible.

  • securityThe golang.org/x/crypto dependency, updated

    The golang.org/x/crypto module is updated to v0.45.0.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.4

    The helm.sh/helm/v3 module is updated to v3.18.4.

  • securityThe helm.sh/helm/v3 dependency, updated to v3.18.5

    The helm.sh/helm/v3 module is updated to v3.18.5.

  • breakingThe plpmtud default, set to blackhole

    The default plpmtud mode is now blackhole (blackhole-detected).

  • breakingThe AddressScopeMax default, set to 254

    The default AddressScopeMax is changed to 254, the host scope, for GKE metadata server and HCP use cases. The related setting is --local-max-addr-scope.

  • breakingThe tls authMode default, set to migration

    tls authMode is set to migration by default.

  • breakingThe CNI deletion timeout, reduced to 1.5 seconds

    The CNI deletion timeout is reduced to 1.5 seconds.

  • breakingThe policy-default-local-cluster default

    policy-default-local-cluster is now set by default.

  • breakingHost firewall bypass, disabled by default

    Host firewall bypass is disabled by default.

  • breakingFQDN match pattern sanitization

    FQDN match pattern sanitization is refactored and tightened.

  • breakingEncrypted traffic forwarding via cilium_host, removed

    Forwarding encrypted traffic via cilium_host has been removed.

  • breakingCNI configuration in the container image, removed

    The CNI configuration is no longer installed in the container image.

Check if affected (30)

  • breakingLocal-cluster default for network policy selectors

    Applies if you do not set cluster in network policy selectors.

  • breakingThe CiliumBGPPeeringPolicy v1 API, removed

    Applies if you use CiliumBGPPeeringPolicy.

  • breakingMutual Authentication, disabled by default

    Applies if you enable Mutual Authentication.

  • + 27 more on the release page

Plan ahead (7)

  • deprecated--enable-ipsec-encrypted-overlay, deprecatedremoval date not announced

    Applies if you use --enable-ipsec-encrypted-overlay.

  • deprecatedKafka match fields and ToRequires and FromRequires, deprecated

    Applies if you use ToRequires or FromRequires.

  • deprecatedTLS certificate and key Helm values, deprecated

    Applies if you pass TLS certificates or keys in Helm values.

  • + 4 more on the release page
Source ↗
Ciliumv1.18.6Networking & MessagingJan 13, 2026
ACTION 1OTHER 21View full analysis

A maintenance release with fixes for networking, policy, proxy, gateway API, and endpoint handling, plus dependency, image, and OCI publishing updates. The Cilium Preflight check no longer includes Envoy Configmaps.

Action needed (1)

  • breakingCilium Preflight check no longer includes Envoy Configmaps

    The Cilium Preflight check no longer includes Envoy Configmaps. This change ships in v1.18.6.

Source ↗
Envoyv1.37.0Networking & MessagingJan 13, 2026
ACTION 1CHECK 2PLAN 1OTHER 30View full analysis

This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.

Action needed (1)

  • breakingRuntime guards and legacy code paths removed

    Multiple runtime guards and legacy code paths are removed in this release.

Check if affected (2)

  • breakingDefault HTTP reset code changed

    Applicability is not stated in the release notes.

  • breakingDefault upstream protocol error reset handling changed

    Applicability is not stated in the release notes.

Plan ahead (1)

  • deprecatedOpenTelemetry access log common_config field deprecated

    Applies if you configure common_config.

Source ↗
← Newer
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023