Releases

Check if affected (4)

• securitycriticalCVE-2025-68121 TLS session resumption validation

  Applies if you use Config.Clone with mutations or Config.GetConfigForClient.

  This release fixes crypto/tls session resumption when ClientCAs or RootCAs change between the initial and resumed handshake. The fix covers configurations using Config.Clone with mutations or Config.GetConfigForClient.

• securityGateway deployment controller resource validation

  Applies if the gateway deployment controller runs.

  This release adds safeguards to the gateway deployment controller that validate object types, names, and namespaces before creating Kubernetes resources. The validation prevents arbitrary resource creation through template injection.

• securityResource annotation validation against container injection

  Applies if you configure resource annotations.

  This release updates resource annotation validation to reject newlines and control characters. The change prevents template rendering from injecting containers into pod specifications.

• + 1 more on the release page

Check if affected (2)

• securityGateway deployment controller resource validation

  Applies if the gateway deployment controller runs.

  The gateway deployment controller now validates object types, names, and namespaces before creating Kubernetes resources through template rendering. This prevents arbitrary resource creation through template injection.

• breakingNamespace-based authorization for debug endpoints

  Applies if you use debug endpoints on port 15014.

  Namespace-based authorization now restricts non-system access on port 15014 to the config_dump, ndsz, and edsz endpoints and to same-namespace proxies. Compatibility behavior can be disabled with ENABLE_DEBUG_ENDPOINT_AUTH=false.