RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY
AllAction neededCheck if affectedPlan ahead
KIND
AllSecurityBreakingDeprecated
Category
AllAI & MLCI/CD & App DeliveryKubernetes CoreNetworking & MessagingObservabilityOrchestration & ManagementProvisioning & RuntimeSecurityStorage & Data
etcdv3.7.1Kubernetes CoreJul 23, 2026
ACTION 3CHECK 1OTHER 2View full analysis

A maintenance release changes server defaults and behavior, fixes correctness issues, and addresses disclosed security issues in watch permissions and google.golang.org/grpc. It also includes fixes for unbounded peer lease HTTP request reads and nested transaction request handling.

Action needed (3)

  • securityhighThe google.golang.org/grpc dependency update

    The release updates google.golang.org/grpc to version 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default

    The release sets a reasonable default value for snapshotLimitByte.

  • breakingThe client HTTP server ReadHeaderTimeout

    The client HTTP server now sets ReadHeaderTimeout.

Check if affected (1)

  • securityhighWatch responses restricted to authorized keys

    Applicability is not stated in the release notes.

Source ↗
etcdv3.6.14Kubernetes CoreJul 23, 2026
ACTION 5OTHER 5View full analysis

A maintenance release with security fixes, dependency updates, and changes to defaults and behavior. The changed snapshotLimitByte default and the security fixes are the main release concerns; other correctness fixes require no setup changes.

Action needed (5)

  • securitycriticalThe golang.org/x/net dependency update

    The golang.org/x/net dependency is updated from 0.54.0 to 0.55.0 to address CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-25680, and CVE-2026-42506.

  • securityhighAuthorization fix for watch responses, GHSA-xg4h-6gfc-h4m8

    An authorization issue is fixed where a user with read permission on one key could receive watch responses for every key starting from that key. This addresses GHSA-xg4h-6gfc-h4m8.

  • securityhighThe tlsHandshakeTimeout setting for tlsListener, GHSA-6vch-q96h-7gc3

    The release sets tlsHandshakeTimeout for tlsListener. This addresses GHSA-6vch-q96h-7gc3.

  • securityhighThe google.golang.org/grpc dependency update

    The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

  • breakingThe snapshotLimitByte default value

    The default value for snapshotLimitByte is set to a reasonable value in this release.

Source ↗
etcdv3.5.33Kubernetes CoreJul 23, 2026
ACTION 5OTHER 5View full analysis

A maintenance release with correctness and security fixes, timeout behavior changes, and dependency and toolchain updates. It also updates the build toolchain used to compile binaries.

Action needed (5)

  • securityhighWatch response authorization for key ranges

    The watch authorization issue is fixed: a user with read permission on one key could no longer receive watch responses for every key starting from that key. The fix addresses GHSA-xg4h-6gfc-h4m8.

  • securityhighThe tlsHandshakeTimeout setting for tlsListener

    A tlsHandshakeTimeout is set for tlsListener. The change addresses GHSA-6vch-q96h-7gc3.

  • securityhighThe golang.org/x/net dependency, updated to v0.56.0

    The golang.org/x/net dependency is updated to v0.56.0 to address GO-2026-5942.

  • securityhighThe golang.org/x/text dependency, updated to v0.39.0

    The golang.org/x/text dependency is updated to v0.39.0 to address GO-2026-5970.

  • securityhighThe google.golang.org/grpc dependency, updated to 1.82.1

    The google.golang.org/grpc dependency is updated to 1.82.1 to address GHSA-hrxh-6v49-42gf.

Source ↗
Crossplanev2.3.4Orchestration & ManagementJul 23, 2026
ACTION 7OTHER 5View full analysis

This release includes operator-visible defect corrections and an image-build behavior change alongside dependency updates for security fixes. Upgrading incorporates the security fixes in the dependency updates, while the remaining changes require no setup action.

Action needed (7)

  • securityThe github.com/sigstore/rekor module update to v1.5.2

    Crossplane v2.3.4 updates the github.com/sigstore/rekor module to v1.5.2 for security fixes.

  • securityThe github.com/sigstore/cosign/v3 module update to v3.0.6

    Crossplane v2.3.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6 for security fixes.

  • securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0

    Crossplane v2.3.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0 for security fixes.

  • securityThe github.com/sigstore/sigstore-go module update to v1.2.0

    Crossplane v2.3.4 updates the github.com/sigstore/sigstore-go module to v1.2.0 for security fixes.

  • securityCombined security dependency updates

    Crossplane v2.3.4 includes combined security updates for grpc, golang.org/x/net, and golang.org/x/text.

  • securityThe golang.org/x/text module update to v0.39.0

    Crossplane v2.3.4 updates the golang.org/x/text module to v0.39.0 for security fixes.

  • securityThe golang.org/x/net module update to v0.56.0

    Crossplane v2.3.4 updates the golang.org/x/net module to v0.56.0 for security fixes.

Source ↗
Crossplanev2.2.4Orchestration & ManagementJul 23, 2026
ACTION 5OTHER 2View full analysis

Crossplane v2.2.4 fixes a Usage-controller reconciliation defect and changes image builds to use buildGoModule, so published images can be scanned by standard vulnerability tooling. It also includes security-related dependency updates.

Action needed (5)

  • securityThe github.com/sigstore/rekor module update to v1.5.2

    Crossplane v2.2.4 updates the github.com/sigstore/rekor module to v1.5.2.

  • securityThe github.com/sigstore/cosign/v3 module update to v3.0.6

    Crossplane v2.2.4 updates the github.com/sigstore/cosign/v3 module to v3.0.6.

  • securityThe github.com/sigstore/timestamp-authority/v2 module update to v2.1.0

    Crossplane v2.2.4 updates the github.com/sigstore/timestamp-authority/v2 module to v2.1.0.

  • securityThe github.com/sigstore/sigstore-go module update to v1.2.0

    Crossplane v2.2.4 updates the github.com/sigstore/sigstore-go module to v1.2.0.

  • securityCombined grpc, x/net, and x/text dependency updates

    Crossplane v2.2.4 applies combined security updates to grpc, x/net, and x/text.

Source ↗
Crossplanev2.1.8Orchestration & ManagementJul 23, 2026
ACTION 7OTHER 1View full analysis

Crossplane v2.1.8 is a maintenance release with several security-related dependency and toolchain updates. It also fixes repeated owner updates for composed Usages by checking all owner references instead of only the first.

Action needed (7)

  • securityThe github.com/sigstore/rekor module at v1.5.2

    The github.com/sigstore/rekor module is updated to v1.5.2 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/timestamp-authority/v2 module at v2.1.0

    The github.com/sigstore/timestamp-authority/v2 module is updated to v2.1.0 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/cosign/v2 module at v2.6.3

    The github.com/sigstore/cosign/v2 module is updated to v2.6.3 in Crossplane v2.1.8.

  • securityThe Go toolchain at 1.25.12

    The Go toolchain is updated to 1.25.12 in Crossplane v2.1.8.

  • securityThe github.com/sigstore/sigstore-go module at v1.2.0

    The github.com/sigstore/sigstore-go module is updated to v1.2.0 in Crossplane v2.1.8.

  • securityCombined grpc, x/net, and x/text dependency updates

    Combined security dependency updates cover grpc, x/net, and x/text in Crossplane v2.1.8.

  • securityThe golang.org/x/text module at v0.39.0

    The golang.org/x/text module is updated to v0.39.0 in Crossplane v2.1.8.

Source ↗
Crossplanev1.20.11Orchestration & ManagementJul 23, 2026
ACTION 4OTHER 1View full analysis

A maintenance release fixes repeated owner updates in the Usage controller and includes security-related dependency and toolchain upgrades. It updates the runtime dependency set, Go toolchain, and Alpine base image in the release-1.20 line.

Action needed (4)

  • securityThe github.com/sigstore/rekor module, updated to v1.5.2

    The github.com/sigstore/rekor module is updated to v1.5.2 in the release-1.20 line.

  • securityThe Go toolchain, updated to 1.25.12

    The Go toolchain is updated to 1.25.12 in the release-1.20 line.

  • securityThe alpine Docker tag, updated to v3.24

    The alpine Docker tag is updated to v3.24 in the release-1.20 line.

  • securitySecurity updates for grpc, x/net, and x/text

    Security updates are applied to grpc, x/net, and x/text in the release-1.20 line.

Source ↗
Daprv1.18.2Orchestration & ManagementJul 21, 2026
ACTION 3OTHER 18View full analysis

A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.

Action needed (3)

  • securitymediumgithub.com/go-chi/chi/v5 updated for CVE-2025-69725

    github.com/go-chi/chi/v5 is updated to v5.2.4, which resolves CVE-2025-69725.

  • securitymediumgo.mongodb.org/mongo-driver and github.com/dapr/components-contrib updates

    go.mongodb.org/mongo-driver is updated to v1.17.7, and the github.com/dapr/components-contrib dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.

  • breakingConflict errors for workflow instance IDs

    Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.

Source ↗
Litmus3.31.0ObservabilityJul 15, 2026
ACTION 1OTHER 9View full analysis

Release 3.31.0 contains a dependency update addressing vulnerabilities in graphql/server. It also includes correctness fixes across probes, GraphQL, authentication, infrastructure, and experiment handling.

Action needed (1)

  • securityDependencies in graphql/server updated

    Dependencies in graphql/server are updated to fix vulnerabilities. The update ships in Release 3.31.0.

Source ↗
Kyvernov1.18.2SecurityJul 10, 2026
ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

  • securitySecurity dependency updates

    Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

  • securityNamespace-boundary enforcement in generator.apply()

    Applies if you use generator.apply().

Source ↗
Helmv3.21.3Kubernetes CoreJul 9, 2026
ACTION 1OTHER 1View full analysis

This release includes a security-related dependency cleanup and a dependency update. The github.com/containerd/containerd dependency moves from 1.7.32 to 1.7.33.

Action needed (1)

  • securityThe containerd v1 dependency, removed

    The containerd v1 dependency is removed in Helm v3.21.3 to resolve govulncheck CVEs associated with 037733e7d51b08e30a0233bd546c345ab3ea3bba.

Source ↗
SPIREv1.15.2SecurityJul 9, 2026
ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

  • securityMigration from github.com/docker/docker to github.com/moby/moby

    Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.

  • breakingRPC metrics from agent health check loopback calls

    Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

  • breakingJWT-SVID serving by the delegated API

    Applies if you use the delegated API for admin or downstream entries.

Source ↗
Flatcar Container Linuxstable-4593.2.4Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update focused on fixes for disclosed Linux vulnerabilities. It also updates the Linux and ca-certificates dependencies.

Action needed (1)

Source ↗
Flatcar Container Linuxlts-4081.3.9Provisioning & RuntimeJul 9, 2026
ACTION 1OTHER 2View full analysis

This Flatcar release is a security update with fixes for Linux issues identified by CVE advisories. It also updates Linux and ca-certificates.

Action needed (1)

Source ↗
Prometheusv3.5.5ObservabilityJul 9, 2026
ACTION 1OTHER 1View full analysis

Prometheus v3.5.5 includes a Go 1.25.12 toolchain change and a disclosed security fix in the UI. The security fix concerns the sanitize-html dependency and CVE-2026-53606.

Action needed (1)

  • securitymediumThe sanitize-html dependency update for CVE-2026-53606

    The Prometheus UI updates sanitize-html to v2.17.5 to fix CVE-2026-53606.

Source ↗
Keycloak26.7.0SecurityJul 9, 2026
ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

  • securityPre-account takeover attack exposure

    The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

Plan ahead (4)

  • deprecatedThe V1 API, deprecated

    Applies if you use V1.

  • deprecatedThe Require Discoverable Credential option, deprecated

    Applies if you configure the Require Discoverable Credential option.

  • deprecatedThe Twitter IDP implementation, deprecated

    Applies if you use the Twitter IDP implementation.

  • + 1 more on the release page
Source ↗
TiKVv8.5.7Storage & DataJul 9, 2026
ACTION 1CHECK 1OTHER 41View full analysis

A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.

Action needed (1)

  • securityThird-party dependency upgrades for TiKV 8.5

    TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.

Check if affected (1)

  • breakingInvalid max_ts updates rejected by default

    Applies if you do not set storage.max-ts.action-on-invalid-update.

Source ↗
etcdv3.7.0Kubernetes CoreJul 8, 2026
ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if you configure --listen-client-http-urls.

Source ↗
Thanosv0.42.0ObservabilityJul 8, 2026
ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

  • securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186

    The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

  • securityReceive tenant ID validation

    Applies if you run Receive.

  • breakingQuery-Frontend time_taken field renamed to time_taken_ms

    Applies if you run Query-Frontend.

  • breaking--shipper.ignore-unequal-block-size flag removed

    Applies if you configure --shipper.ignore-unequal-block-size.

  • + 1 more on the release page
Source ↗
Tektonv1.6.5CI/CD & App DeliveryJul 8, 2026
ACTION 1View full analysis

This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.

Action needed (1)

  • securityGo 1.25.10 dependency update

    Go is updated to 1.25.10 for CVE remediation in this release.

Source ↗
Tektonv1.9.6CI/CD & App DeliveryJul 8, 2026
ACTION 3View full analysis

Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang.org packages, with no specific advisory identifiers or vulnerability details in the note.

Action needed (3)

  • securityGo 1.25.10 update

    Go is updated to 1.25.10 for CVE remediation in v1.9.6.

  • securitygolang.org/x/crypto v0.52.0 update

    golang.org/x/crypto is updated to v0.52.0 for CVE remediation in v1.9.6.

  • securitygolang.org/x/net v0.55.0 update

    golang.org/x/net is updated to v0.55.0 for CVE remediation in v1.9.6.

Source ↗
Harborv2.15.2Storage & DataJul 2, 2026
ACTION 1CHECK 2OTHER 21View full analysis

A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.

Action needed (1)

  • securityToken and blob-mount source validation

    Blob-mount source projects are validated, and tokens without iat are rejected.

Check if affected (2)

  • breakingThe bundled PostgreSQL version, upgraded

    Applies if you use PostgreSQL.

  • breakingThe cache backend, changed from redis to valkey

    Applies if you use redis.

Source ↗
etcdv3.6.13Kubernetes CoreJul 1, 2026
ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

  • securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0

    The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

  • securityhighgolang.org/x/crypto, updated to v0.52.0

    The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

  • securityCRL enforcement bypass on the gRPC listener, fixed

    Applies if --listen-client-http-urls is configured.

Source ↗
etcdv3.5.32Kubernetes CoreJul 1, 2026
ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

  • securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883

    go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

  • securityCRL enforcement with --listen-client-http-urls

    Applies if --listen-client-http-urls is configured.

Source ↗
Prometheusv3.13.0ObservabilityJul 1, 2026
ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

  • securitycriticalThe sanitize-html dependency update

    The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.

  • breakingThe third-party license artifact

    Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

  • securitymediumRedirect credential forwarding

    Applies if you use scraping, remote read/write, alerting, or service discovery.

  • breakingPromQL duration-expression function names

    Applies if you enable experimental-duration-expr and use min() and max().

Source ↗
wasmCloudv2.5.0Orchestration & ManagementJun 30, 2026
ACTION 1CHECK 1OTHER 21View full analysis

Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.

Action needed (1)

  • securityhighThe quinn-proto security fix

    The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.

Check if affected (1)

  • breakingDefault wasip3 enablement with wasmtime 46

    Applies if your workloads use wasip3.

Source ↗
Tektonv1.14.0CI/CD & App DeliveryJun 30, 2026
ACTION 1OTHER 37View full analysis

Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.

Action needed (1)

  • securityGo 1.26.4 update

    Go is updated to 1.26.4 in v1.14.0 for CVE remediation.

Source ↗
Karmadav1.18.1Orchestration & ManagementJun 30, 2026
ACTION 1OTHER 1View full analysis

This release updates the Alpine base image and fixes a Helm chart TLS certificate issue. The Helm fix applies to deployments that use a custom namespace, while the base image change addresses security concerns.

Action needed (1)

  • securityThe alpine base image, upgraded

    The alpine base image is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗
Karmadav1.17.4Orchestration & ManagementJun 30, 2026
ACTION 1OTHER 1View full analysis

Karmada v1.17.4 updates its Alpine base image to address security concerns. The release also fixes a Helm chart TLS certificate SAN mismatch when deploying to a custom namespace.

Action needed (1)

  • securityThe alpine base image, updated to alpine:3.24.1

    The alpine base image is updated from alpine:3.23.4 to alpine:3.24.1 to address security concerns. The update ships in Karmada v1.17.4.

Source ↗
Karmadav1.16.7Orchestration & ManagementJun 30, 2026
ACTION 1OTHER 1View full analysis

Karmada v1.16.7 updates its Alpine base image for security concerns and includes a Helm chart fix for TLS certificate SANs in custom namespaces. The release affects deployments that use the updated image or the affected Helm chart configuration.

Action needed (1)

  • securityThe alpine base image, updated

    The base image alpine is promoted from alpine:3.23.4 to alpine:3.24.1 to address security concerns.

Source ↗
Keycloak26.6.4SecurityJun 26, 2026
ACTION 8OTHER 1View full analysis

Version 26.6.4 is a security-focused Keycloak release with fixes for disclosed vulnerabilities. It also upgrades Quarkus to 3.33.2.1, an informational dependency change for operators.

Action needed (8)

  • securityhighCVE-2026-9099, group-admin escalation to realm-admin

    Version 26.6.4 fixes the group-admin escalation to realm-admin identified as CVE-2026-9099 in Keycloak.

  • securityhighCVE-2026-9086, cross-site scripting via URI validation bypass

    Version 26.6.4 fixes the cross-site scripting issue caused by a case-insensitive URI validation bypass identified as CVE-2026-9086 in Keycloak.

  • securityhighCVE-2026-9795, improper scope mapping enforcement

    Version 26.6.4 fixes the privilege escalation caused by improper scope mapping enforcement identified as CVE-2026-9795 in Keycloak.

  • securityhighCVE-2026-9800, policy enforcer URI comparison

    Version 26.6.4 fixes the authorization bypass caused by incorrect URI comparison in the Keycloak policy enforcer, identified as CVE-2026-9800.

  • securityhighCVE-2026-11800, JWT algorithm confusion authentication bypass

    Version 26.6.4 fixes the JWT algorithm confusion authentication bypass identified as CVE-2026-11800 in Keycloak.

  • securitymediumCVE-2026-9083, arbitrary filesystem path probing

    Version 26.6.4 fixes the information disclosure through arbitrary filesystem path probing identified as CVE-2026-9083 in Keycloak.

  • securitymediumCVE-2026-9705, disabled client takeover

    Version 26.6.4 fixes the issue identified as CVE-2026-9705, which allowed disabled clients to be re-enabled and taken over through a registration access token in Keycloak.

  • securitymediumCVE-2026-9799, UMA permission ticket bypass

    Version 26.6.4 fixes the unauthorized resource access caused by a UMA permission ticket bypass identified as CVE-2026-9799 in Keycloak.

Source ↗
cert-managerv1.19.6SecurityJun 25, 2026
ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

  • securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507

    Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

  • securityGo 1.25.10 dependency upgrade

    Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

  • securityReduced cert-manager-edit permissions for Challenge and Order creation and updates

    Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.

Source ↗
cert-managerv1.20.3SecurityJun 25, 2026
ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

Check if affected (1)

  • securityThe cert-manager-edit aggregate ClusterRole permissions

    Applicability is not stated in the release notes.

Source ↗
Istio1.28.9Networking & MessagingJun 24, 2026
ACTION 7CHECK 7View full analysis

A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.

Action needed (7)

  • securityhighCVE-2026-48044, Zstd decompressor ratio enforcement

    CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.

  • securitymediumCVE-2026-47692, PROXY protocol TLV length validation

    CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.

  • securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling

    CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.

  • securitymediumCVE-2026-48090, asynchronous token callback lifetime

    CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.

  • securitymediumCVE-2026-47778, peer certificate SAN validation

    CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.

  • securitymediumCVE-2026-48497, query name length checking

    CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.

  • securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix

    GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.

Check if affected (7)

  • securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation

    Applies if you enable envoy.reloadable_features.quic_validate_headers_only_content_length.

  • securityhighCVE-2026-48042, JSON parser nesting depth limit

    Applies if you set envoy.reloadable_features.limit_json_parser_nesting_depth to false.

  • securitymediumCVE-2026-47207, ext_proc server response handling

    Applies if you use the ext_proc server.

  • + 4 more on the release page
Source ↗
Istio1.29.5Networking & MessagingJun 24, 2026
ACTION 4CHECK 11OTHER 5View full analysis

A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.

Action needed (4)

  • securitymediumCVE-2026-47221 in HTTP 303 internal redirects

    CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.

  • securitymediumCVE-2026-48090 in asynchronous token change callbacks

    CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.

  • securitymediumCVE-2026-47778 in peer certificate SAN validation

    CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.

  • securitymediumCVE-2026-48497 query name length checking

    CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.

Check if affected (11)

  • securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter

    Applies if you configure the %REQUESTED_SERVER_NAME% formatter.

  • securityhighCVE-2026-48044 in the Zstd decompressor

    Applies if you use the Zstd decompressor.

  • securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation

    Applies if you use HTTP/3 and enable envoy.reloadable_features.quic_validate_headers_only_content_length.

  • + 8 more on the release page
Source ↗
Istio1.30.2Networking & MessagingJun 24, 2026
ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

  • securityhighCVE-2026-47220 crash bug fix

    The Envoy security update fixes the crash bug described by CVE-2026-47220.

  • securityhighCVE-2026-48044 memory exhaustion fix

    The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.

  • securityhighCVE-2026-48042 JSON nesting-depth limit

    The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.

  • securitymediumCVE-2026-47692 bug fix

    The Envoy security update fixes the bug described by CVE-2026-47692.

  • securitymediumCVE-2026-47205 use-after-free crash fix

    The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.

  • securitymediumCVE-2026-48090 asynchronous token callback handling

    The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.

  • securitymediumCVE-2026-47778 Subject Alternative Name validation

    The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).

  • securitymediumCVE-2026-47204 crash and use-after-free fix

    The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.

  • securitymediumCVE-2026-48497 query name length checking

    The Envoy security update fixes sanity checking of the query name length.

  • securitymediumCVE-2026-47775 padding oracle

    The Envoy security update addresses a padding oracle described by CVE-2026-47775.

  • securityGHSA-p7c7-7c47-pwch denial-of-service fix

    The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.

  • breakingWarn-level message logging

    The message is now logged at warn level.

Check if affected (5)

Source ↗
Envoyv1.38.3Networking & MessagingJun 23, 2026
ACTION 16CHECK 2View full analysis

A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.

Action needed (16)

  • securityhighThe com_github_wasmtime dependency update

    The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.

  • securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220

    The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.

  • securityhighzstd RLE zip bomb, CVE-2026-48044

    The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

  • securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042

    The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

  • securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743

    The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.

  • securitymediumAuthz per route crash, CVE-2026-47205

    The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.

  • securitymediumThe ext_proc response issue, CVE-2026-47207

    The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.

  • securitymediumRouter internal redirects crash, CVE-2026-47221

    The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.

  • securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775

    The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.

  • securitymediumThe grpc_stats filter segfault, CVE-2026-47204

    The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.

  • securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692

    The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.

  • securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778

    The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.

  • securitymediumOAuth2 filter late token completion, CVE-2026-48090

    The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.

  • securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497

    The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.

  • securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706

    The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.

  • securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch

    The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.

Check if affected (2)

  • breakingThe envoy.network.connection_balance.dlb extension removal

    Applies if you use envoy.network.connection_balance.dlb.

  • breakingThe envoy.reloadable_features.tls_certificate_compression_brotli default

    Applies if you do not configure envoy.reloadable_features.tls_certificate_compression_brotli.

Source ↗
Envoyv1.37.5Networking & MessagingJun 23, 2026
ACTION 1CHECK 16View full analysis

A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy.network.connection_balance.dlb contrib extension at the Bazel layer for all builds and platforms.

Action needed (1)

  • securityhighcom_github_wasmtime dependency update, CVE-2026-47261

    The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Check if affected (16)

Source ↗
Envoyv1.36.9Networking & MessagingJun 23, 2026
ACTION 1CHECK 15View full analysis

A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy.network.connection_balance.dlb is disabled in all builds.

Action needed (1)

  • securityhighHighly nested JSON destructor stack overflow

    The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (15)

  • securityhighzstd RLE zip bomb correction

    Applies if you use zstd.

  • securityhighHTTP/3 to HTTP/1 request smuggling

    Applies if you use HTTP/3 and HTTP/1.

  • securityhighcom_github_wasmtime dependency update

    Applies if you use wasm.

  • + 12 more on the release page
Source ↗
Envoyv1.35.13Networking & MessagingJun 23, 2026
ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

  • securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042

    This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

Source ↗
← NewerOlder →
Browse by month
Aug 2026Jul 2026Jun 2026May 2026Apr 2026Mar 2026Feb 2026Jan 2026Dec 2025Nov 2025Oct 2025Sep 2025Aug 2025Jul 2025Jun 2025May 2025Apr 2025Mar 2025Feb 2025Jan 2025Dec 2024Nov 2024Oct 2024Sep 2024Aug 2024Jul 2024Jun 2024May 2024Apr 2024Mar 2024Feb 2024Jan 2024Dec 2023Nov 2023Oct 2023Sep 2023