Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

Contourv1.33.4Networking & MessagingApr 20, 2026

A release with a fix for Lua code injection, a required Envoy version change, and an Envoy dependency update. It is tested against Kubernetes 1.32 through 1.34.

Check if affected (2)

securityhighCVE-2026-41246 fix for cookieRewritePolicies[].pathRewrite.value
Applies if you use HTTPProxy resources.
CVE-2026-41246 and GHSA-x4mj-7f9g-29h4 address arbitrary code execution in the Envoy proxy. An attacker with RBAC permissions to create or modify HTTPProxy resources could exploit a malicious cookieRewritePolicies[].pathRewrite.value.
breakingEnvoy 1.35.0 minimum version
Applies if you depend on Envoy.
This release requires Envoy 1.35.0 or later.

Source ↗