Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: IstioClear ×

Istio1.30.2Networking & MessagingJun 24, 2026

ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.

Check if affected (5)

securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
The Envoy security update fixes HTTP/3 headers-only request and response content-length validation, including the envoy.reloadable_features.quic_validate_headers_only_content_length feature.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
The Envoy security update fixes a bug where the ext_proc server sends unexpected ProcessingResponses to Envoy.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
The Envoy security update fixes an issue when handling HTTP 303 internal redirects.
+ 2 more on the release page

Source ↗

Istio1.30.0Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

breakingDefault Istio image registry
The default registry for Istio images is now registry.istio.io.

Check if affected (1)

breakingAuthentication required for XDS debug endpoints
Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.
The XDS debug endpoints, syncz and config_dump, on port 15010 now require authentication when ENABLE_DEBUG_ENDPOINT_AUTH=true, which is the default.

Source ↗

Istio1.29.2Networking & MessagingApr 13, 2026

ACTION 1OTHER 15View full analysis

A maintenance release adds Helm v4 server-side apply support and includes numerous correctness fixes. The WASM decompression size-limit change affects inputs that were previously accepted and may require operator review.

Action needed (1)

breakingThe gzip decompression size limit for WASM binaries
A size limit is now enforced on gzip-decompressed WASM binaries fetched over HTTP.

Source ↗

Istio1.29.0Networking & MessagingFeb 16, 2026

ACTION 1CHECK 4OTHER 18View full analysis

This release adds operator-visible capabilities and changes several runtime defaults. Ambient mesh behavior, debug endpoint authorization, metrics compression, and istiod memory and circuit-breaker behavior receive particular attention.

Action needed (1)

breakingAutomatic GOMEMLIMIT setting for istiod
istiod now automatically sets GOMEMLIMIT to 90% of its memory limits through the automemlimit library. This reduces the risk of OOM kills while maintaining performance.

Check if affected (4)

breakingDefault iptables reconciliation
Applies when the istio-cni DaemonSet is upgraded.
iptables reconciliation is enabled by default. It updates network rules automatically when the istio-cni DaemonSet is upgraded.
breakingDefault debug endpoint authorization
Applies to debug endpoints on port 15014.
Debug endpoint authorization is enabled by default for debug endpoints on port 15014. It provides namespace-based access controls.
breakingDefault HTTP compression for Envoy metrics
Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.
HTTP compression for Envoy metrics is enabled by default at the Prometheus stats endpoint. Compression uses brotli, gzip, or zstd based on client Accept-Header values.
+ 1 more on the release page

Source ↗

Browse by month