Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Strimzi1.2.0Networking & MessagingAug 20, 2026

ACTION 2CHECK 3OTHER 7View full analysis

This release removes legacy CRD API versions and resource state metrics, and changes defaults for token mounting, feature gates, and container security contexts. It also adds Kafka and configuration capabilities and updates shipped dependencies.

Action needed (2)

breakingService Account token mounting
Service Account tokens are no longer auto-mounted into Pods. They are mounted through a volume instead.
breakingThe ServerSideApplyPhase1 feature gate, permanently enabled
The ServerSideApplyPhase1 feature gate has moved to GA and is permanently enabled. It can no longer be disabled.

Check if affected (3)

breakingLegacy CRD API versions, no longer supported
Applies before upgrading to Strimzi 1.0.0 or later if you use the v1beta2, v1beta1, or v1alpha1 APIs.
breakingResource state metrics, removed
Applicability is not stated in the release notes.
breakingDefault securityContext for operator installations
Applies if you use the Cluster, Topic, and User Operator YAML installation files or the Cluster Operator Helm Chart.

Source ↗

Ciliumv1.20.1Networking & MessagingAug 18, 2026

CHECK 1OTHER 51View full analysis

A maintenance release with numerous operator-facing bug fixes and behavior corrections, alongside dependency and image updates. It also introduces a decoder-memory limit and fixes a CIDR policy bypass that could cause traffic drops after an agent restart.

Check if affected (1)

securityThe endpoint CIDR policy bypass, fixed
Applicability is not stated in the release notes.

Source ↗

Contourv1.33.6Networking & MessagingAug 12, 2026

ACTION 1CHECK 1OTHER 3View full analysis

A maintenance release with a security fix for an external authorization bypass and dependency updates for CVE fixes. It also updates the tested Kubernetes range to 1.32 through 1.34, Go to 1.25.12, and Envoy to v1.38.3.

Action needed (1)

securityDependency updates for CVE fixes
Dependencies were updated to fix CVEs. The updates ship in Contour v1.33.6.

Check if affected (1)

securityExternal authorization bypass with disabled authPolicy
Applies if authPolicy is not configured.

Source ↗

NATSv2.14.4Networking & MessagingJul 30, 2026

CHECK 4OTHER 37View full analysis

A maintenance release with dependency and toolchain updates, JetStream performance and configuration improvements, and broad correctness fixes. It also includes authentication and permission fixes.

Check if affected (4)

securityJWT validation with whitespace-only permissions
Applies if you use JWT validation.
securityverify_and_map authentication with blank passwords
Applies if TLS verify_and_map is configured.
securityMQTT subscription restriction for $MQTT.> subjects
Applies if you use MQTT.
+ 1 more on the release page

Source ↗

NATSv2.12.14Networking & MessagingJul 30, 2026

ACTION 1CHECK 2OTHER 33View full analysis

A maintenance release with a Go toolchain update, dependency manifest updates, JetStream performance and configuration changes, and numerous correctness fixes. Authentication fixes address security flaws and require upgrading.

Action needed (1)

breakingThe disk concurrency semaphore, increased to 4096 slots
The disk concurrency semaphore is now set to 4096 slots, up from the previous CPU-scaled count. This performance change ships in v2.12.14.

Check if affected (2)

securityAuthentication checks with no_auth_user and auth callouts
Applies if you configure no_auth_user and use auth callouts.
securityTLS verify_and_map authentication with blank passwords
Applies if you use TLS and configure verify_and_map.

Source ↗

Ciliumv1.20.0Networking & MessagingJul 29, 2026

ACTION 11CHECK 28PLAN 6OTHER 478View full analysis

A substantial feature and maintenance release with Gateway API, networking, IPAM, policy, observability, and datapath changes, alongside correctness and performance fixes. Operators should review removed or renamed options, changed defaults and requirements, removed metrics and integrations, and the dependency updates addressing security-related issues.

Action needed (11)

securitygoogle.golang.org/grpc v1.79.3
The google.golang.org/grpc module is updated to v1.79.3 in the main branch.
securitygoogle.golang.org/grpc v1.82.1
The google.golang.org/grpc module is updated to v1.82.1 in the v1.20 branch.
securityhelm.sh/helm/v4 v4.1.4
The helm.sh/helm/v4 module is updated to v4.1.4 in the main branch.
securitygithub.com/cloudflare/circl v1.6.3
The github.com/cloudflare/circl module is updated to v1.6.3.
securitygithub.com/go-jose/go-jose/v4 v4.1.4
The github.com/go-jose/go-jose/v4 module is updated to v4.1.4.
securitygithub.com/moby/spdystream v0.5.1
The github.com/moby/spdystream module is updated to v0.5.1.
breakingcni.customConf CNI configuration version
The default CNI configuration version for cni.customConf changes from 0.3.1 to 1.0.0.
breakingCilium operator IPAM metrics removal
The IPAM metrics cilium_operator_ipam_ips and cilium_operator_ipam_available_interfaces are removed.
breakingDefault CNI configuration version
The default CNI configuration version changes from 0.3.1 to 1.0.0.
breakingNative histogram default
Native histograms are emitted for all histograms by default.
breakingAgent bootstrap metrics removal
Agent bootstrap metrics are removed.

Check if affected (28)

securitytbid traffic host namespace handling
Applies if you use tbid traffic.
breakingDocker libnetwork plugin removal
Applies if you use the Docker libnetwork plugin.
breakingces-slice-mode removal
Applies if you configure ces-slice-mode.
+ 25 more on the release page

Plan ahead (6)

deprecatedBeta Mutual Auth deprecationremoval date not announced
Applies if you use Mutual Auth.
deprecatedDeprecated address and interface CIDR fields
Applies if you configure addresses[].subnet or interfaces[].cidr.
deprecatedLocal REST BGP API deprecationremoval date not announced
Applies if you use the local REST BGP APIs.
+ 3 more on the release page

Source ↗

gRPCv1.83.0Networking & MessagingJul 22, 2026

CHECK 1View full analysis

This release includes a security-related default change in TLS key exchange. The change affects deployments that use TLS key exchange.

Check if affected (1)

securityPost-Quantum Cryptography as the default for TLS key exchange
Applies when TLS key exchange is used.

Source ↗

Linkerdedge-26.7.1Networking & MessagingJul 21, 2026

ACTION 1CHECK 1OTHER 58View full analysis

This release tightens Gateway API and service-port handling and corrects tracing identity construction. It also updates dependencies and shipped components, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingUndefined service port requests disallowed
The destination component now disallows requests to service ports that are not defined.

Check if affected (1)

breakingGateway API checks during Helm installation
Applies when you use Helm.

Source ↗

Ciliumv1.19.6Networking & MessagingJul 16, 2026

CHECK 1OTHER 46View full analysis

A maintenance release with numerous correctness fixes, Gateway API and telemetry additions, dependency and image updates, and internal behavior changes. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingHelm handling of hostFirewall.enabled disablement
Applies when you use Helm to disable hostFirewall.enabled, toggling it from true to false.

Source ↗

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
+ 8 more on the release page

Source ↗

gRPCv1.82.1Networking & MessagingJul 8, 2026

CHECK 1View full analysis

A dependency-focused release raises the minimum supported Python protobuf version. The headings contain no operator-facing changes.

Check if affected (1)

breakingThe Python protobuf dependency lower bound, raised
Applies if you use Python.

Source ↗

gRPCv1.82.0Networking & MessagingJul 2, 2026

CHECK 1OTHER 12View full analysis

A feature and maintenance release that adds and changes capabilities across Core, PHP, Python, and Ruby, corrects runtime defects, and upgrades protobuf dependencies. The Python 1.82.0 package was removed from PyPI.

Check if affected (1)

breakinggRPC Python release 1.82.0, yanked from PyPI
Applies if you use gRPC Python release 1.82.0.

Source ↗

NATSv2.14.3Networking & MessagingJun 29, 2026

CHECK 3OTHER 42View full analysis

A maintenance release with a dependency and toolchain update, broad defect corrections, and behavior improvements across authentication, routing, monitoring, clustering, and JetStream. It also removes JSONP monitoring callbacks and addresses MQTT and authorization-related connection and permission handling.

Check if affected (3)

securityNats-Trace-Dest publish permission checks for leaf connections
Applies if you use Leaf connections.
securityMQTT subscribe deny rules on retained message and QoS replay paths
Applies if you use MQTT.
breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.

Source ↗

NATSv2.12.12Networking & MessagingJun 29, 2026

CHECK 1OTHER 45View full analysis

A maintenance release with dependency updates, operational behavior changes, and correctness fixes across General, MQTT, Monitoring, and JetStream. It also removes JSONP callback support from monitoring endpoints.

Check if affected (1)

breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.

Source ↗

Strimzi1.1.0Networking & MessagingJun 27, 2026

CHECK 3OTHER 21View full analysis

This release adds operator-facing configuration and feature capabilities while updating supported Apache Kafka versions and related integrations. It also changes TLS file handling for KafkaBridge and KafkaMirrorMaker2 and renames entity-operator healthcheck ports, so those areas may require attention.

Check if affected (3)

breakingSupport for Kafka 4.1.x removed
Applies if you use Kafka 4.1.x.
breakingPEM-based TLS files for KafkaBridge and KafkaMirrorMaker2
Applies if you use KafkaBridge or KafkaMirrorMaker2 with TLS authentication or a TLS truststore.
breakingEntity-operator healthcheck port names
Applies if you use entity-operator healthcheck ports.

Source ↗

Istio1.28.9Networking & MessagingJun 24, 2026

ACTION 7CHECK 7View full analysis

A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.

Action needed (7)

securityhighCVE-2026-48044, Zstd decompressor ratio enforcement
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.
securitymediumCVE-2026-47692, PROXY protocol TLV length validation
CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.
securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling
CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.
securitymediumCVE-2026-48090, asynchronous token callback lifetime
CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.
securitymediumCVE-2026-47778, peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.
securitymediumCVE-2026-48497, query name length checking
CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.
securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix
GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.

Check if affected (7)

securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation
Applies if you enable envoy.reloadable_features.quic_validate_headers_only_content_length.
securityhighCVE-2026-48042, JSON parser nesting depth limit
Applies if you set envoy.reloadable_features.limit_json_parser_nesting_depth to false.
securitymediumCVE-2026-47207, ext_proc server response handling
Applies if you use the ext_proc server.
+ 4 more on the release page

Source ↗

Istio1.29.5Networking & MessagingJun 24, 2026

ACTION 4CHECK 11OTHER 5View full analysis

A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.

Action needed (4)

securitymediumCVE-2026-47221 in HTTP 303 internal redirects
CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.
securitymediumCVE-2026-48090 in asynchronous token change callbacks
CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.
securitymediumCVE-2026-47778 in peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.
securitymediumCVE-2026-48497 query name length checking
CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.

Check if affected (11)

securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter
Applies if you configure the %REQUESTED_SERVER_NAME% formatter.
securityhighCVE-2026-48044 in the Zstd decompressor
Applies if you use the Zstd decompressor.
securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation
Applies if you use HTTP/3 and enable envoy.reloadable_features.quic_validate_headers_only_content_length.
+ 8 more on the release page

Source ↗

Istio1.30.2Networking & MessagingJun 24, 2026

ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.

Check if affected (5)

securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
+ 2 more on the release page

Source ↗

Envoyv1.38.3Networking & MessagingJun 23, 2026

ACTION 16CHECK 2View full analysis

A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.

Action needed (16)

securityhighThe com_github_wasmtime dependency update
The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.
securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220
The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb, CVE-2026-48044
The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042
The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securitymediumAuthz per route crash, CVE-2026-47205
The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.
securitymediumThe ext_proc response issue, CVE-2026-47207
The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.
securitymediumRouter internal redirects crash, CVE-2026-47221
The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.
securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775
The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.
securitymediumThe grpc_stats filter segfault, CVE-2026-47204
The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.
securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692
The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.
securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778
The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.
securitymediumOAuth2 filter late token completion, CVE-2026-48090
The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.
securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497
The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.
securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706
The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.
securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch
The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.

Check if affected (2)

breakingThe envoy.network.connection_balance.dlb extension removal
Applies if you use envoy.network.connection_balance.dlb.
breakingThe envoy.reloadable_features.tls_certificate_compression_brotli default
Applies if you do not configure envoy.reloadable_features.tls_certificate_compression_brotli.

Source ↗

Envoyv1.37.5Networking & MessagingJun 23, 2026

ACTION 1CHECK 16View full analysis

A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy.network.connection_balance.dlb contrib extension at the Bazel layer for all builds and platforms.

Action needed (1)

securityhighcom_github_wasmtime dependency update, CVE-2026-47261
The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Check if affected (16)

securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220
Applies if you configure REQUESTED_SERVER_NAME.
securityhighzstd RLE zip bomb fix, CVE-2026-48044
Applies if you depend on zstd.
securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042
Applies if you use JSON.
+ 13 more on the release page

Source ↗

Envoyv1.36.9Networking & MessagingJun 23, 2026

ACTION 1CHECK 15View full analysis

A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy.network.connection_balance.dlb is disabled in all builds.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow
The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (15)

securityhighzstd RLE zip bomb correction
Applies if you use zstd.
securityhighHTTP/3 to HTTP/1 request smuggling
Applies if you use HTTP/3 and HTTP/1.
securityhighcom_github_wasmtime dependency update
Applies if you use wasm.
+ 12 more on the release page

Source ↗

Envoyv1.35.13Networking & MessagingJun 23, 2026

ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042
This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

securityhighzstd RLE zip bomb, corrected for CVE-2026-48044
Applies if you use zstd.
securityhighHTTP/3 headers-only content-length validation, corrected for CVE-2026-48743
Applies if you use HTTP/3.
securityhighcom_github_wasmtime dependency update for CVE-2026-47261
Applies if you use wasm.
+ 11 more on the release page

Source ↗

Strimzi1.0.1Networking & MessagingJun 17, 2026

ACTION 2CHECK 2View full analysis

A release focused on CRD compatibility and Entity Operator watching defaults, with fixes for disclosed security vulnerabilities. It affects deployments using older CRD APIs or configuring cross-namespace watching.

Action needed (2)

securityhighFix for CVE-2026-55225
The release fixes CVE-2026-55225, also identified as GHSA-mw9r-p8xp-wx96.
securitymediumFix for CVE-2026-55226
The release fixes CVE-2026-55226, also identified as GHSA-r427-j2h7-wv3m.

Check if affected (2)

breakingSupported CRD API versions narrowed
Applies if you use the v1beta2, v1beta1, or v1alpha1 CRD APIs.
breakingEntity Operator cross-namespace watching default
Applies if you configure STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED or watchedNamespace.

Source ↗

Ciliumv1.19.5Networking & MessagingJun 16, 2026

CHECK 3OTHER 48View full analysis

A maintenance-focused release with correctness fixes, dependency updates, operator troubleshooting improvements, and a security fix for a namespace-bypass issue. It also removes obsolete Helm settings, so configurations using those values need review.

Check if affected (3)

securityWildcard namespace bypass for selectorless ipBlock rules, fixed
Applies if you configure ipBlock.
breakingThe loadBalancer.standalone Helm option, removed
Applies if you configure loadBalancer.standalone.
breakingThe l2podAnnouncements.interface Helm value, replaced by l2podAnnouncements.interfacePattern
Applies if you configure l2podAnnouncements.interface and enable L2 pod announcements.

Source ↗

Linkerdedge-26.6.2Networking & MessagingJun 16, 2026

CHECK 1OTHER 18View full analysis

A release with narrower ExternalWorkloads endpoint behavior, annotation support for upcoming load-balancing features, policy and profile fixes, dependency updates, and new load-biasing functionality. This release is explicitly not recommended in favor of edge-26.6.3.

Check if affected (1)

breakingNamespace-restricted ExternalWorkloads endpoints
Applies if you use ExternalWorkloads.

Source ↗

NATSv2.12.11Networking & MessagingJun 9, 2026

CHECK 3OTHER 18View full analysis

A feature and behavior release for JetStream and server operations, with new capabilities alongside changed defaults and downgrade constraints. Operators using strict JetStream requests, insecure TLS cipher suites, or new v2.12 features should review the changed behavior; the release also fixes a JetStream regression.

Check if affected (3)

breakingInsecure TLS cipher suite default
Applies if you enable allow_insecure_cipher_suites.
breakingJetStream strict mode default
Applies if you use JetStream.
breakingDowngrade compatibility for new v2.12 features
Applies if you use new v2.12 features.

Source ↗

gRPCv1.81.1Networking & MessagingJun 8, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with fixes for correctness defects and a change to the default availability of the error_flatten experiment. It also includes an internal implementation change with no operator-facing impact.

Check if affected (1)

breakingThe error_flatten experiment, enabled in OSS
Applicability is not stated in the release notes.

Source ↗

Istio1.30.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 1OTHER 15View full analysis

A maintenance release with an Envoy denial-of-service security fix, defect corrections, new operator-facing capabilities, a dependency update, and removal of a feature-gate guard. The security fix addresses disclosed advisory CVE-2026-47774.

Action needed (1)

securityhighCVE-2026-47774 Envoy denial-of-service fix
The fix addresses CVE-2026-47774 in Envoy, where specially crafted HTTP/2 requests could exhaust process memory because decoded header size was not fully limited during request validation.

Check if affected (1)

breakingPILOT_ENABLE_ALPHA_GATEWAY_API guard removed from ListenerSet
Applies if you use the ListenerSet API.

Source ↗

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Source ↗

Envoyv1.37.3Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

securityhighnghttp2 CVE-2026-27135 patch
The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

securityhighHTTP/2 header list limits and cookie accounting
Applies if you use HTTP/2.
securityOAuth2 HMAC verification timing
Applies if you use oauth2.

Source ↗

Envoyv1.36.7Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 with configured header list or request-header limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use the OAuth2 filter.

Source ↗

Envoyv1.35.11Networking & MessagingJun 3, 2026

ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

securityhighHTTP/2 header limits and cookie accounting
Applies if you use HTTP/2 request header limits.
securityOAuth2 HMAC verification timing protection
Applies if you use OAuth2 HMAC verification.

Source ↗

Contourv1.33.5Networking & MessagingMay 28, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A maintenance release with a security fix for invalid HTTPProxy configurations and an update to golang.org/x/net. It also updates the Go toolchain to 1.25.10 and is tested against Kubernetes 1.32 through 1.34.

Action needed (1)

securitycriticalgolang.org/x/net updated to v0.55.0, CVE-2026-39821
Contour v1.33.5 updates golang.org/x/net to v0.55.0. The change addresses CVE-2026-39821.

Check if affected (1)

securitymediumInvalid HTTPProxy configuration rejected, GHSA-g3xr-5w5j-w4q4
Applies if you configure HTTPProxy with a fallback certificate and enable JWT verification.

Source ↗

Istio1.30.0Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 33View full analysis

A feature release adds Gateway API, ambient-mode, telemetry, Helm, and operability capabilities. Authenticated XDS debug endpoints and the new default image registry are the changes most likely to affect deployment and operational configuration.

Action needed (1)

breakingDefault Istio image registry
The default registry for Istio images is now registry.istio.io.

Check if affected (1)

breakingAuthentication required for XDS debug endpoints
Applies if ENABLE_DEBUG_ENDPOINT_AUTH is set.

Source ↗

Istio1.29.3Networking & MessagingMay 18, 2026

ACTION 1CHECK 2OTHER 6View full analysis

A maintenance release adds Gateway API compatibility, analyzer and HBONE tuning capabilities, and fixes certificate, controller, probe, output, and authorization issues. The authorization fixes address cross-namespace configuration access and regex handling in AuthorizationPolicy.

Action needed (1)

securityCross-namespace access to istio.io/debug/syncz and istio.io/debug/config_dump
Authorization is fixed so an authenticated workload cannot enumerate proxies or retrieve configuration dumps for workloads in other namespaces through istio.io/debug/syncz and istio.io/debug/config_dump.

Check if affected (2)

securityRegex handling in AuthorizationPolicy identity fields
Applicability is not stated in the release notes.
breakingThe AMBIENT_ENABLE_AWS_BRANCH_ENI_PROBE setting and kubelet health probes
Applies when ambient mesh pods run on AWS EKS and use Security Groups for Pods (branch ENI).

Source ↗

Istio1.28.7Networking & MessagingMay 18, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release that adds Gateway API v1.4.1 support and new diagnostics and configuration controls while fixing several correctness issues. It also includes two described security fixes for XDS debug endpoint authorization and regex handling in AuthorizationPolicy.

Action needed (1)

securitySame-namespace authorization for StatusGen XDS debug endpoints
The StatusGen-served XDS debug endpoints istio.io/debug/syncz and istio.io/debug/config_dump now enforce same-namespace authorization for non-system callers. Authenticated workloads can no longer enumerate proxies or retrieve configuration dumps for workloads in other namespaces.

Check if affected (1)

securityEscaped regex metacharacters in AuthorizationPolicy identity fields
Applies if you configure source.principals or source.namespaces.

Source ↗

Ciliumv1.19.4Networking & MessagingMay 13, 2026

ACTION 2CHECK 1OTHER 46View full analysis

A maintenance release with several operator-visible fixes, narrower EndpointSlice watch behavior, Helm configurability, and dependency and image updates. The EndpointSlice filtering change affects configurations that set a service proxy name, while the release also updates the github.com/moby/spdystream dependency.

Action needed (2)

securityThe github.com/moby/spdystream module update
The github.com/moby/spdystream module is updated to v0.5.1.
breakingService-label filtering for EndpointSlice watches
The loadbalancer/reflectors component filters EndpointSlice watches by service labels.

Check if affected (1)

breakingLabel filtering for EndpointSlices
Applies if you set --k8s-service-proxy-name.

Source ↗

Ciliumv1.17.16Networking & MessagingMay 13, 2026

ACTION 1CHECK 1OTHER 23View full analysis

A maintenance release with an enforced policy behavior change, bug fixes, new metrics, and Helm image overrides. It also updates dependencies and container images and refreshes container image manifests.

Action needed (1)

securityThe github.com/moby/spdystream dependency update
The github.com/moby/spdystream module is updated to v0.5.1 in v1.17.16.

Check if affected (1)

breakingCiliumLocalRedirectPolicy addressMatcher override behavior
Applies if you use addressMatcher in CiliumLocalRedirectPolicy and do not enable --enable-lrp-address-matcher-override=true.

Source ↗

Linkerdedge-26.5.1Networking & MessagingMay 1, 2026

CHECK 1OTHER 13View full analysis

This release narrows Kubernetes support to version 1.31 or newer. It also adds multicluster gateway configuration, reduces destination-controller memory usage, corrects namespace-aware service cleanup, and updates third-party dependencies.

Check if affected (1)

breakingMinimum supported Kubernetes version, 1.31
Applies when your cluster runs Kubernetes older than 1.31.

Source ↗

NATSv2.14.0Networking & MessagingApr 30, 2026

CHECK 1OTHER 25View full analysis

A feature release adds JetStream, leafnode, configuration, and protocol capabilities alongside fixes. Operator attention is needed for the narrowed MQTT retained-message subject constraint and ACL updates when domain-aware acknowledgements and flow control are enabled; the Go toolchain version also changes.

Check if affected (1)

breakingThe retained-message subject constraint
Applies if you use retained messages.

Source ↗

Aug 20, 2026 – Apr 30, 2026Older →

Browse by month