Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

KubeVelav1.11.0CI/CD & App DeliveryJul 20, 2026

CHECK 3OTHER 67View full analysis

A release with operator-facing authorization and credential-handling fixes, alongside new Helm, CUE, and workflow capabilities. It also adds validation improvements and dependency updates.

Check if affected (3)

securityExplicit authorization for vela-system definitions
Applies if you use vela-system definitions.
securityCredential redaction for Terraform module remote URLs
Applies if you configure Terraform module remote URLs.
breakingUndeclared parameter validation in application definitions
Applies if you use application definitions.

Source ↗

Jaegerv2.20.0ObservabilityJul 20, 2026

ACTION 1CHECK 3PLAN 1OTHER 27View full analysis

A release with backend compatibility removals, forced migrations, new configuration and CLI capabilities, and correctness fixes across storage, extensions, and related components. It does not disclose security advisories or security-specific flaws.

Action needed (1)

breakingTemplate creation through esclient
Template creation moves to esclient, and legacy mapping rendering is retired.

Check if affected (3)

breakingSupport for elasticsearch v6, removed
Applies if you use elasticsearch v6.
breakingThe jaegermcp extension, merged into jaegerquery
Applies if you use the jaegermcp extension.
breakingExpired stable feature gates, removed
Applicability is not stated in the release notes.

Plan ahead (1)

deprecatedThe legacy flag, deprecated
Applies if you use legacy flag.

Source ↗

Ciliumv1.19.6Networking & MessagingJul 16, 2026

CHECK 1OTHER 46View full analysis

A maintenance release with numerous correctness fixes, Gateway API and telemetry additions, dependency and image updates, and internal behavior changes. No security advisories or explicitly described vulnerabilities are present.

Check if affected (1)

breakingHelm handling of hostFirewall.enabled disablement
Applies when you use Helm to disable hostFirewall.enabled, toggling it from true to false.

Source ↗

KubeEdgev1.23.1Provisioning & RuntimeJul 15, 2026

CHECK 1OTHER 7View full analysis

A feature and behavior release that adds Windows and device-management capabilities, changes edge database and node-querying behavior, and updates the Kubernetes dependency. Device status retrieval now uses the new DeviceStatus CRD.

Check if affected (1)

breakingThe DeviceStatus CRD for device status retrieval
Applies if you use the DeviceStatus CRD.

Source ↗

KubeEdgev1.21.2Provisioning & RuntimeJul 15, 2026

CHECK 6PLAN 1OTHER 10View full analysis

This release combines correctness fixes with changes to node-job behavior, operator capabilities, and command workflows. It introduces configuration updates for edge nodes, which are disabled by default and require an EdgeCore restart; no security advisories are identified.

Check if affected (6)

breakingThe v1alpha2 NodeUpgradeJob and ImagePrePullJob defaults
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingNode-job switching constraint
Applies if you use NodeUpgradeJob or ImagePrePullJob.
breakingThe taskManager node-job module, disabled by default
Applies if EdgeCore is running.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe v1alpha1 NodeUpgradeJob and ImagePrePullJob jobs, deprecated
Applies if you use NodeUpgradeJob or ImagePrePullJob.

Source ↗

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
+ 8 more on the release page

Source ↗

Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026

ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
breakingMutually exclusive userGroupMember.path and user.filter configuration
Applies if you configure both userGroupMember.path and user.filter.
+ 9 more on the release page

Plan ahead (3)

deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
deprecatedStable auth.clientIdMetadataDocuments configuration
Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.

Source ↗

Buildpacksv0.40.8CI/CD & App DeliveryJul 13, 2026

CHECK 1OTHER 3View full analysis

A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.

Check if affected (1)

securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856
Applies if you use 1.25.11 -> 1.25.12.

Source ↗

Kyvernov1.18.2SecurityJul 10, 2026

ACTION 1CHECK 1OTHER 5View full analysis

A maintenance release with operator-relevant fixes and behavior changes, plus security work in the 1.18 release line. It includes namespace-boundary enforcement for generators and security dependency updates.

Action needed (1)

securitySecurity dependency updates
Security dependency updates from #16340 are backported to release-1.18.

Check if affected (1)

securityNamespace-boundary enforcement in generator.apply()
Applies if you use generator.apply().

Source ↗

CoreDNSv1.14.5Kubernetes CoreJul 10, 2026

ACTION 1CHECK 1OTHER 30View full analysis

A release with operator-visible behavior corrections, new capabilities, configuration changes, and updated defaults. The changes span CoreDNS core behavior and multiple plugins, with no security advisories or explicitly described vulnerabilities.

Action needed (1)

breakingGo TLS defaults in core
The core component uses Go TLS defaults in this release.

Check if affected (1)

breakingDefault truncate amount for bare truncate
Applies if you configure truncate.

Source ↗

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.

Source ↗

SPIREv1.15.2SecurityJul 9, 2026

ACTION 2CHECK 1OTHER 32View full analysis

A feature and behavior release that adds operator-facing configuration and integration options while changing supported inputs and runtime behavior. It also includes a dependency migration for disclosed CVEs and deprecates no existing operator feature.

Action needed (2)

securityMigration from github.com/docker/docker to github.com/moby/moby
Dependencies from github.com/docker/docker were migrated to their github.com/moby/moby equivalents to resolve CVEs. The migration ships in this release.
breakingRPC metrics from agent health check loopback calls
Agent health check loopback calls no longer emit RPC metrics. This reduces metrics noise in the agent.

Check if affected (1)

breakingJWT-SVID serving by the delegated API
Applies if you use the delegated API for admin or downstream entries.

Source ↗

Keycloak26.7.0SecurityJul 9, 2026

ACTION 1CHECK 19PLAN 4OTHER 258View full analysis

A substantial operator-focused release that adds and promotes APIs, feature gates, administration capabilities, and deployment options. It also includes deprecations and removals, along with fixes for account takeover, log injection and audit forgery, key-attestation bypass, QR-code dimension denial of service, and four CVE-identified vulnerabilities.

Action needed (1)

securityPre-account takeover attack exposure
The release corrects an issue that provided room for pre-account takeover attacks.

Check if affected (19)

securitymediumCVE-2026-9796, admin role rename authorization
Applies if you use manage-clients.
securitymediumCVE-2026-9689, OIDC redirect URI parameter handling
Applies if you use OIDC.
securitymediumCVE-2026-9798, CIBA account lockout
Applies if you run the CIBA authentication flow.
+ 16 more on the release page

Plan ahead (4)

deprecatedThe V1 API, deprecated
Applies if you use V1.
deprecatedThe Require Discoverable Credential option, deprecated
Applies if you configure the Require Discoverable Credential option.
deprecatedThe Twitter IDP implementation, deprecated
Applies if you use the Twitter IDP implementation.
+ 1 more on the release page

Source ↗

TiKVv8.5.7Storage & DataJul 9, 2026

ACTION 1CHECK 1OTHER 41View full analysis

A feature and maintenance release with new configuration and resource-management capabilities, plus corrections for invalid timestamp handling, memory use, and stability. It also upgrades vulnerable third-party dependencies and aligns compatibility fixes with upstream.

Action needed (1)

securityThird-party dependency upgrades for TiKV 8.5
TiKV 8.5 upgrades vulnerable third-party dependencies and aligns the required compatibility fixes with upstream.

Check if affected (1)

breakingInvalid max_ts updates rejected by default
Applies if you do not set storage.max-ts.action-on-invalid-update.

Source ↗

cert-managerv1.21.0SecurityJul 8, 2026

CHECK 5PLAN 2OTHER 38View full analysis

A feature and maintenance release with operator-facing RBAC, Helm, API, and feature-gate changes, alongside new capabilities and defect corrections. It includes changes to configuration, permissions, certificate issuance, and integrations.

Check if affected (5)

securitycert-manager-edit aggregate ClusterRole permission removal, GHSA-8rvj-mm4h-c258
Applies if you use the cert-manager-edit aggregate ClusterRole.
breakingObjectReference API removal
Applies if you use ObjectReference in an API.
breakingPrometheus ServiceMonitor and PodMonitor Helm value removal
Applies if you configure any of prometheus.servicemonitor.targetPort, prometheus.servicemonitor.path, or prometheus.podmonitor.path.
+ 2 more on the release page

Plan ahead (2)

deprecatedGateway API controller configuration fields
Applies if you configure any of enableGatewayAPI, enableGatewayAPIListenerSet, gatewayAPI.enabled, or gatewayAPI.enableListenerSet.
deprecatedServerSideApply feature gate deprecation

Source ↗

etcdv3.7.0Kubernetes CoreJul 8, 2026

ACTION 1CHECK 1OTHER 4View full analysis

A maintenance release with security fixes, an authentication correction, and dependency and toolchain updates. The security-related changes address CRL enforcement and golang.org/x/crypto.

Action needed (1)

securityhighgolang.org/x/crypto updated to v0.52.0
The release updates golang.org/x/crypto to v0.52.0 to resolve CVE-2026-46598, CVE-2026-39835, CVE-2026-39828, and CVE-2026-46597.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if you configure --listen-client-http-urls.

Source ↗

Thanosv0.42.0ObservabilityJul 8, 2026

ACTION 1CHECK 4OTHER 19View full analysis

A release with security corrections, breaking configuration removals, and an output-field rename that may require operator or log-collector changes. It also adds TLS and cache configuration, query and tracing changes, and defect fixes across several Thanos components.

Action needed (1)

securitycriticalthanos-community/grpc-go fork update for CVE-2026-33186
The thanos-community/grpc-go fork is bumped to fix CVE-2026-33186, an authorization bypass via malformed :path headers.

Check if affected (4)

securityReceive tenant ID validation
Applies if you run Receive.
breakingQuery-Frontend time_taken field renamed to time_taken_ms
Applies if you run Query-Frontend.
breaking--shipper.ignore-unequal-block-size flag removed
Applies if you configure --shipper.ignore-unequal-block-size.
+ 1 more on the release page

Source ↗

gRPCv1.82.1Networking & MessagingJul 8, 2026

CHECK 1View full analysis

A dependency-focused release raises the minimum supported Python protobuf version. The headings contain no operator-facing changes.

Check if affected (1)

breakingThe Python protobuf dependency lower bound, raised
Applies if you use Python.

Source ↗

k8gbv0.20.0Kubernetes CoreJul 3, 2026

CHECK 4OTHER 49View full analysis

k8gb v0.20.0 centers on ZoneDelegation-based DNS management, with TLSRoute and annotation support alongside changes to defaults and naming. The release also includes defect fixes and dependency updates, and no security advisories or vulnerabilities are identified.

Check if affected (4)

breakingThe Bootstrap service, removed
Applies if your configuration uses the Bootstrap service.
breakingThe dynamicZones setting, removed
Applies if your configuration uses dynamicZones.
breakingThe doFinalize default, set to false
Applies if you use doFinalize in ZoneDelegation finalization.
+ 1 more on the release page

Source ↗

gRPCv1.82.0Networking & MessagingJul 2, 2026

CHECK 1OTHER 12View full analysis

A feature and maintenance release that adds and changes capabilities across Core, PHP, Python, and Ruby, corrects runtime defects, and upgrades protobuf dependencies. The Python 1.82.0 package was removed from PyPI.

Check if affected (1)

breakinggRPC Python release 1.82.0, yanked from PyPI
Applies if you use gRPC Python release 1.82.0.

Source ↗

Harborv2.15.2Storage & DataJul 2, 2026

ACTION 1CHECK 2OTHER 21View full analysis

A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.

Action needed (1)

securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without iat are rejected.

Check if affected (2)

breakingThe bundled PostgreSQL version, upgraded
Applies if you use PostgreSQL.
breakingThe cache backend, changed from redis to valkey
Applies if you use redis.

Source ↗

etcdv3.6.13Kubernetes CoreJul 1, 2026

ACTION 2CHECK 1OTHER 3View full analysis

A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.

Action needed (2)

securityhighgo.opentelemetry.io/otel dependencies, updated to v1.43.0
The go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk dependencies are updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.
securityhighgolang.org/x/crypto, updated to v0.52.0
The golang.org/x/crypto dependency is updated to v0.52.0. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.

Check if affected (1)

securityCRL enforcement bypass on the gRPC listener, fixed
Applies if --listen-client-http-urls is configured.

Source ↗

etcdv3.5.32Kubernetes CoreJul 1, 2026

ACTION 1CHECK 1OTHER 6View full analysis

A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.

Action needed (1)

securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk were updated from v1.40.0 to v1.43.0. The updates address CVE-2026-29181 and CVE-2026-39883.

Check if affected (1)

securityCRL enforcement with --listen-client-http-urls
Applies if --listen-client-http-urls is configured.

Source ↗

Prometheusv3.13.0ObservabilityJul 1, 2026

ACTION 2CHECK 2OTHER 37View full analysis

A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.

Action needed (2)

securitycriticalThe sanitize-html dependency update
The UI updates sanitize-html to address a cross-site scripting vulnerability, identified as CVE-2026-44990.
breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at /assets/third-party-licenses.txt. This replaces the npm_licenses.tar.bz2 archive previously shipped in release tarballs and container images.

Check if affected (2)

securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable experimental-duration-expr and use min() and max().

Source ↗

wasmCloudv2.5.0Orchestration & ManagementJun 30, 2026

ACTION 1CHECK 1OTHER 21View full analysis

Version v2.5.0 adds runtime and WIT/API capabilities and includes correctness and dependency updates. The release also enables wasip3 by default and includes a quinn-proto fix for RUSTSEC-2026-0185.

Action needed (1)

securityhighThe quinn-proto security fix
The quinn-proto dependency fix ships in wasmCloud v2.5.0 and addresses RUSTSEC-2026-0185.

Check if affected (1)

breakingDefault wasip3 enablement with wasmtime 46
Applies if your workloads use wasip3.

Source ↗

Fluxv2.9.0CI/CD & App DeliveryJun 30, 2026

CHECK 1OTHER 56View full analysis

Flux v2.9.0 removes two deprecated API versions and adds CLI and controller capabilities across several Flux resources. It also changes supported Kubernetes versions, corrects defects, and updates project and third-party dependencies.

Check if affected (1)

breakingRemoval of deprecated Flux API versions
Applies if your CRDs use the image.toolkit.fluxcd.io/v1beta2 or notification.toolkit.fluxcd.io/v1beta2 APIs.

Source ↗

Kubescapev4.0.10SecurityJun 30, 2026

CHECK 1OTHER 53View full analysis

This release removes an orphan CRD, adds operator-facing capabilities and output changes, and corrects runtime, validation, reporting, and scan-processing defects. No security advisories or explicitly exploitable vulnerabilities are disclosed.

Check if affected (1)

breakingSecurityException CRD removal
Applies if you use the SecurityException CRD.

Source ↗

KubeVelav1.10.9CI/CD & App DeliveryJun 30, 2026

CHECK 1OTHER 1View full analysis

A maintenance release with a security fix for unbounded reads in the Terraform remote configuration loader and a correctness fix for CUE imports in status details. It also adds repository ownership metadata.

Check if affected (1)

securityUnbounded read prevention in the Terraform remote configuration loader
Applies if you use the Terraform remote configuration loader.

Source ↗

KubeVelav1.9.14CI/CD & App DeliveryJun 30, 2026

CHECK 1OTHER 1View full analysis

This release includes a security correction for an unbounded-read denial-of-service condition in the Terraform remote configuration loader. The fix is backported to release-1.9 and concerns deployments that use this loader.

Check if affected (1)

securityTerraform remote configuration loader DoS fix (GHSA-fmgp-q6jx-gg3x)
Applies if you use the Terraform remote configuration loader.

Source ↗

NATSv2.14.3Networking & MessagingJun 29, 2026

CHECK 3OTHER 42View full analysis

A maintenance release with a dependency and toolchain update, broad defect corrections, and behavior improvements across authentication, routing, monitoring, clustering, and JetStream. It also removes JSONP monitoring callbacks and addresses MQTT and authorization-related connection and permission handling.

Check if affected (3)

securityNats-Trace-Dest publish permission checks for leaf connections
Applies if you use Leaf connections.
securityMQTT subscribe deny rules on retained message and QoS replay paths
Applies if you use MQTT.
breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.

Source ↗

NATSv2.12.12Networking & MessagingJun 29, 2026

CHECK 1OTHER 45View full analysis

A maintenance release with dependency updates, operational behavior changes, and correctness fixes across General, MQTT, Monitoring, and JetStream. It also removes JSONP callback support from monitoring endpoints.

Check if affected (1)

breakingThe JSONP callback support in monitoring endpoints, removed
Applies if you use JSONP callback support.

Source ↗

Strimzi1.1.0Networking & MessagingJun 27, 2026

CHECK 3OTHER 21View full analysis

This release adds operator-facing configuration and feature capabilities while updating supported Apache Kafka versions and related integrations. It also changes TLS file handling for KafkaBridge and KafkaMirrorMaker2 and renames entity-operator healthcheck ports, so those areas may require attention.

Check if affected (3)

breakingSupport for Kafka 4.1.x removed
Applies if you use Kafka 4.1.x.
breakingPEM-based TLS files for KafkaBridge and KafkaMirrorMaker2
Applies if you use KafkaBridge or KafkaMirrorMaker2 with TLS authentication or a TLS truststore.
breakingEntity-operator healthcheck port names
Applies if you use entity-operator healthcheck ports.

Source ↗

Open Policy Agent (OPA)v1.18.0SecurityJun 25, 2026

CHECK 1OTHER 22View full analysis

A release with a breaking change to the outbound User-Agent value, along with restored automatic GOMAXPROCS handling and new automatic GOMEMLIMIT support. It also improves formatting and coverage behavior, corrects compiler and runtime defects, and updates dependencies.

Check if affected (1)

breakingThe User-Agent header format
Applies if you configure server-side log filters or WAF rules that exact-match the old string.

Source ↗

cert-managerv1.19.6SecurityJun 25, 2026

ACTION 2CHECK 1View full analysis

cert-manager v1.19.6 changes permissions in the cert-manager-edit aggregate ClusterRole and updates the Go toolchain. Workflows that directly create or modify Challenge or Order resources may require explicit permissions after the release.

Action needed (2)

securityhighGo v1.25.11 with fixes for CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507
Go is updated to v1.25.11 in cert-manager v1.19.6 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.
securityGo 1.25.10 dependency upgrade
Go is upgraded to 1.25.10 as part of the dependency updates in cert-manager v1.19.6.

Check if affected (1)

securityReduced cert-manager-edit permissions for Challenge and Order creation and updates
Applies if you use the cert-manager-edit aggregate ClusterRole for workflows that create or modify Challenge or Order resources.

Source ↗

cert-managerv1.20.3SecurityJun 25, 2026

ACTION 1CHECK 1OTHER 2View full analysis

A security-focused patch release removes unsafe ACME permissions and includes fixes for identified CVEs. It also corrects Challenge garbage collection and updates Go dependencies.

Action needed (1)

securityhighGo updated to v1.26.4
Go is updated to v1.26.4 to fix CVE-2026-27145, CVE-2026-42504, and CVE-2026-42507.

Check if affected (1)

securityThe cert-manager-edit aggregate ClusterRole permissions
Applicability is not stated in the release notes.

Source ↗

Fluentdv1.19.3ObservabilityJun 25, 2026

CHECK 2OTHER 11View full analysis

A maintenance release with bug fixes, behavior changes, and two operator-visible default changes. It also updates a runtime dependency and tightens validation and payload handling; no security vulnerability or advisory is explicitly identified.

Check if affected (2)

breakingThe in_monitor_agent visibility default
Applies if in_monitor_agent runs.
breakingThe in_debug_agent local-machine default
Applies if in_debug_agent runs.

Source ↗

Dragonflyv2.5.0Storage & DataJun 25, 2026

ACTION 1CHECK 1OTHER 17View full analysis

v2.5.0 adds operator-facing capabilities and changes download and proxy behavior. Deprecated API surface is removed and correctness issues are fixed; no security advisory is disclosed.

Action needed (1)

breakingHealth checks consolidated to /healthy
Health checks are consolidated to the /healthy endpoint in v2.5.0.

Check if affected (1)

breakingDeprecated V1 preheat API endpoints removed
Applies if you use the deprecated V1 preheat API endpoints.

Source ↗

Istio1.28.9Networking & MessagingJun 24, 2026

ACTION 7CHECK 7View full analysis

A maintenance release with disclosed Envoy security fixes across HTTP/3 processing, protocol handling, filters, decompression, certificates, and statistics. The corrections are available through an upgrade to this release.

Action needed (7)

securityhighCVE-2026-48044, Zstd decompressor ratio enforcement
CVE-2026-48044 fixes memory exhaustion in the Zstd decompressor by enforcing the MaxInflateRatio limit inside the decompression loop.
securitymediumCVE-2026-47692, PROXY protocol TLV length validation
CVE-2026-47692 fixes a length mismatch when passthrough TLVs and added TLVs exceed the maximum length in the PROXY protocol header.
securitymediumCVE-2026-47221, HTTP 303 body-less redirect handling
CVE-2026-47221 fixes a segmentation fault when handling HTTP 303 internal redirects for requests without a body.
securitymediumCVE-2026-48090, asynchronous token callback lifetime
CVE-2026-48090 fixes a callback that could run after the filter was torn down, preventing access to dangling pointers and the resulting use-after-free crash.
securitymediumCVE-2026-47778, peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte.
securitymediumCVE-2026-48497, query name length checking
CVE-2026-48497 adds sanity checking for query name length and uses ENVOY_BUG when the check fails, avoiding abnormal process termination.
securityGHSA-p7c7-7c47-pwch, QPACK blocked decoding fix
GHSA-p7c7-7c47-pwch fixes a denial-of-service vulnerability in Envoy's HTTP/3 stack caused by QPACK blocked decoding and unbounded memory growth.

Check if affected (7)

securityhighCVE-2026-48743, HTTP/3 headers-only content-length validation
Applies if you enable envoy.reloadable_features.quic_validate_headers_only_content_length.
securityhighCVE-2026-48042, JSON parser nesting depth limit
Applies if you set envoy.reloadable_features.limit_json_parser_nesting_depth to false.
securitymediumCVE-2026-47207, ext_proc server response handling
Applies if you use the ext_proc server.
+ 4 more on the release page

Source ↗

Istio1.29.5Networking & MessagingJun 24, 2026

ACTION 4CHECK 11OTHER 5View full analysis

A maintenance release with Envoy security fixes and five ordinary defect corrections. The security fixes require upgrading, while no deprecations or forced operator configuration changes are announced.

Action needed (4)

securitymediumCVE-2026-47221 in HTTP 303 internal redirects
CVE-2026-47221 fixes handling of HTTP 303 internal redirects for body-less requests. The redirect code no longer attempts to drain an unallocated request body buffer.
securitymediumCVE-2026-48090 in asynchronous token change callbacks
CVE-2026-48090 fixes a bug where an asynchronous token change callback could run after the filter was torn down by onDestroy(), causing dangling-pointer access and a crash.
securitymediumCVE-2026-47778 in peer certificate SAN validation
CVE-2026-47778 fixes validation of a peer certificate's Subject Alternative Name when the SAN contains an embedded NUL byte. SAN parsing no longer permits NUL byte truncation to produce incorrect trust decisions.
securitymediumCVE-2026-48497 query name length checking
CVE-2026-48497 adds sanity checking for query name length to avoid abnormal process termination. The check uses ENVOY_BUG when it fails.

Check if affected (11)

securityhighCVE-2026-47220 in the %REQUESTED_SERVER_NAME% formatter
Applies if you configure the %REQUESTED_SERVER_NAME% formatter.
securityhighCVE-2026-48044 in the Zstd decompressor
Applies if you use the Zstd decompressor.
securityhighCVE-2026-48743 HTTP/3 headers-only content-length validation
Applies if you use HTTP/3 and enable envoy.reloadable_features.quic_validate_headers_only_content_length.
+ 8 more on the release page

Source ↗

Istio1.30.2Networking & MessagingJun 24, 2026

ACTION 12CHECK 5OTHER 7View full analysis

A maintenance release with a changed logging default, operator-facing additions and fixes, and a restriction on pilot-agent metric content types. It also includes Envoy security fixes covering denial-of-service, crashes, validation issues, memory exhaustion, and other vulnerabilities.

Action needed (12)

securityhighCVE-2026-47220 crash bug fix
The Envoy security update fixes the crash bug described by CVE-2026-47220.
securityhighCVE-2026-48044 memory exhaustion fix
The Envoy security update fixes the memory exhaustion vulnerability described by CVE-2026-48044.
securityhighCVE-2026-48042 JSON nesting-depth limit
The Envoy security update limits JSON nesting depth to 1000 through envoy.reloadable_features.limit_json_parser_nesting_depth.
securitymediumCVE-2026-47692 bug fix
The Envoy security update fixes the bug described by CVE-2026-47692.
securitymediumCVE-2026-47205 use-after-free crash fix
The Envoy security update fixes the use-after-free crash described by CVE-2026-47205.
securitymediumCVE-2026-48090 asynchronous token callback handling
The Envoy security update fixes a bug where the asynchronous token change callback could be triggered after the filter had been torn down.
securitymediumCVE-2026-47778 Subject Alternative Name validation
The Envoy security update fixes an issue where Envoy could fail to validate the Subject Alternative Name (SAN).
securitymediumCVE-2026-47204 crash and use-after-free fix
The Envoy security update fixes a crash or use-after-free described by CVE-2026-47204.
securitymediumCVE-2026-48497 query name length checking
The Envoy security update fixes sanity checking of the query name length.
securitymediumCVE-2026-47775 padding oracle
The Envoy security update addresses a padding oracle described by CVE-2026-47775.
securityGHSA-p7c7-7c47-pwch denial-of-service fix
The Envoy security update fixes the denial-of-service vulnerability described by GHSA-p7c7-7c47-pwch.
breakingWarn-level message logging
The message is now logged at warn level.

Check if affected (5)

securityhighCVE-2026-48743 HTTP/3 content-length validation
Applies if you use HTTP/3.
securitymediumCVE-2026-47207 ext_proc response handling
Applies if you use the ext_proc extension.
securitymediumCVE-2026-47221 HTTP 303 redirect handling
Applicability is not stated in the release notes.
+ 2 more on the release page

Source ↗

← NewerJul 20, 2026 – Jun 24, 2026Older →

Browse by month