Releases

Check if affected (4)

• securitycriticalCVE-2025-68121 TLS session resumption validation

  Applies if you use Config.Clone with mutations or Config.GetConfigForClient.

  This release fixes crypto/tls session resumption when ClientCAs or RootCAs change between the initial and resumed handshake. The fix covers configurations using Config.Clone with mutations or Config.GetConfigForClient.

• securityGateway deployment controller resource validation

  Applies if the gateway deployment controller runs.

  This release adds safeguards to the gateway deployment controller that validate object types, names, and namespaces before creating Kubernetes resources. The validation prevents arbitrary resource creation through template injection.

• securityResource annotation validation against container injection

  Applies if you configure resource annotations.

  This release updates resource annotation validation to reject newlines and control characters. The change prevents template rendering from injecting containers into pod specifications.

• + 1 more on the release page

Check if affected (4)

• breakingDefault iptables reconciliation

  Applies when the istio-cni DaemonSet is upgraded.

  iptables reconciliation is enabled by default. It updates network rules automatically when the istio-cni DaemonSet is upgraded.

• breakingDefault debug endpoint authorization

  Applies to debug endpoints on port 15014.

  Debug endpoint authorization is enabled by default for debug endpoints on port 15014. It provides namespace-based access controls.

• breakingDefault HTTP compression for Envoy metrics

  Applies to Envoy metrics at the Prometheus stats endpoint based on client Accept-Header values.

  HTTP compression for Envoy metrics is enabled by default at the Prometheus stats endpoint. Compression uses brotli, gzip, or zstd based on client Accept-Header values.

• + 1 more on the release page

Check if affected (2)

• securityGateway deployment controller resource validation

  Applies if the gateway deployment controller runs.

  The gateway deployment controller now validates object types, names, and namespaces before creating Kubernetes resources through template rendering. This prevents arbitrary resource creation through template injection.

• breakingNamespace-based authorization for debug endpoints

  Applies if you use debug endpoints on port 15014.

  Namespace-based authorization now restricts non-system access on port 15014 to the config_dump, ndsz, and edsz endpoints and to same-namespace proxies. Compatibility behavior can be disabled with ENABLE_DEBUG_ENDPOINT_AUTH=false.