Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jun 2026Clear ×Project: IstioClear ×

Istio1.28.9Networking & MessagingJun 24, 2026

ACTION 7CHECK 7View full analysis

A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.

Action needed (7)

securityhighCVE-2026-48044, Zstd decompressor ratio enforcement
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.
securitymediumCVE-2026-47692, PROXY protocol TLV length validation
CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.
securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling
CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.
securitymediumCVE-2026-48090, asynchronous token callback lifetime
CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.
securitymediumCVE-2026-47778, peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.
securitymediumCVE-2026-48497, query name length checking
CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.
securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix
GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.

Check if affected (7)

securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation
Applies if you enable envoy.reloadable_features.quic_validate_headers_only_content_length.
CVE-2026-48743 validates content lengths for HTTP/3 headers-only requests and responses and resets the stream when the values are inconsistent. The change is guarded by the runtime flag envoy.reloadable_features.quic_validate_headers_only_content_length.
securityhighCVE-2026-48042, JSON parser nesting depth limit
Applies if you set envoy.reloadable_features.limit_json_parser_nesting_depth to false.
CVE-2026-48042 limits JSON nesting depth to 1000. The limit can be relaxed to 10K by setting envoy.reloadable_features.limit_json_parser_nesting_depth to false.
securitymediumCVE-2026-47207, ext_proc server response handling
Applies if you use the ext_proc server.
CVE-2026-47207 fixes unexpected ProcessingResponses sent by the ext_proc server to Envoy.
+ 4 more on the release page

Source ↗

Istio1.29.5Networking & MessagingJun 24, 2026

ACTION 4CHECK 11OTHER 5View full analysis

A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.

Action needed (4)

securitymediumCVE-2026-47221 in HTTP 303 internal redirects
CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.
securitymediumCVE-2026-48090 in asynchronous token change callbacks
CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.
securitymediumCVE-2026-47778 in peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.
securitymediumCVE-2026-48497 query name length checking
CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.

Check if affected (11)

securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter
Applies if you configure the %REQUESTED_SERVER_NAME% formatter.
CVE-2026-47220 fixes a crash in the %REQUESTED_SERVER_NAME% formatter when the host or original host is not set correctly while the formatter accesses the host value.
securityhighCVE-2026-48044 in the Zstd decompressor
Applies if you use the Zstd decompressor.
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor. The MaxInflateRatio limit is now enforced inside the inner decompression loop.
securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation
Applies if you use HTTP/3 and enable envoy.reloadable_features.quic_validate_headers_only_content_length.
CVE-2026-48743 fixes HTTP/3 content-length validation for headers-only requests and responses. Inconsistent content lengths now reset the stream, guarded by the runtime flag envoy.reloadable_features.quic_validate_headers_only_content_length.
+ 8 more on the release page

Source ↗

Istio1.30.2Networking & MessagingJun 24, 2026

ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.

Check if affected (5)

securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
The Envoy security update fixes HTTP/3 headers-only request and response content-length validation, including the envoy.reloadable_features.quic_validate_headers_only_content_length feature.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
The Envoy security update fixes a bug where the ext_proc server sends unexpected ProcessingResponses to Envoy.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
The Envoy security update fixes an issue when handling HTTP 303 internal redirects.
+ 2 more on the release page

Source ↗

Istio1.29.4Networking & MessagingJun 4, 2026

ACTION 1OTHER 6View full analysis

A maintenance release with a security fix for Envoy and operator-relevant correctness fixes across Istio ambient, gateway, routing, and CNI behavior. It also adds automatic fallback from the nftables backend to iptables when the bundled nft binary lacks JSON support.

Action needed (1)

securityhighCVE-2026-47774 Envoy memory exhaustion fix
CVE-2026-47774 fixes an Envoy memory exhaustion issue in which specially crafted HTTP/2 requests could bypass request header size accounting and trigger excessive memory use. The fix ships in Envoy.

Source ↗

Istio1.28.8Networking & MessagingJun 4, 2026

ACTION 1OTHER 3View full analysis

A maintenance release with a disclosed Envoy denial-of-service fix and additional correctness fixes. The security fix addresses memory exhaustion from specially crafted HTTP/2 requests, while the other corrections do not require setup changes.

Action needed (1)

securityhighThe Envoy denial-of-service vulnerability CVE-2026-47774, fixed
CVE-2026-47774 fixes an Envoy denial-of-service vulnerability in which specially crafted HTTP/2 requests could cause excessive memory consumption. The fix accounts for cookie header bytes during request header size validation and limits total decoded header size in HPACK processing.

Source ↗

Istio1.30.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

securityhighCVE-2026-47774 Envoy denial-of-service fix
The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet
Applies if you use the ListenerSet API.
The ListenerSet feature is no longer guarded by the PILOT_ENABLE_ALPHA_GATEWAY_API feature flag because it is no longer experimental in Gateway API v1.5.0.

Source ↗

Browse by month