リリース

gRPC 1.82.0はCore、PHP、Python、Rubyにわたる細かな修正を積み重ねたルーチンリリースで、セキュリティ問題や破壊的変更はありません。目立つのはxDSの2つのプロトコル追加(A85のORCA-to-LRS、A114の重み付けラウンドロビン)と、細々としたバグ修正の集合です。

Istio 1.28.10は単一のバグ修正を含むルーティンパッチです。krtコントローラフレームワークで、Fetchフィルターのキー変更時に古い逆引きインデックスエントリが残り続けるメモリリークを修正しました。

NATS server v2.14.3 is a maintenance release dominated by JetStream, MQTT and clustering bug fixes, with two MQTT fixes closing pre-auth memory exhaustion and panic conditions and one breaking change: JSONP monitoring support has been removed.

• securityMQTT memory exhaustion and panic fixes

  Applies to servers exposing MQTT. Fixed in v2.14.3: malformed partial CONNECT packets could exhaust pre-auth memory, and a PUBLISH remaining-length underflow could panic the server. Upgrade if you run MQTT, especially with untrusted or public clients.

• breakingJSONP monitoring support removed

  Applies to deployments relying on JSONP callbacks against monitoring endpoints (e.g. /varz, /connz via callback= param). This is removed in v2.14.3; switch dashboards or scripts to plain JSON polling before upgrading.

• breakingPermission checks tightened for leaf trace destination and NoAuthUser

  Applies to leaf node setups using Nats-Trace-Dest, and to accounts using NoAuthUser. Fixed in v2.14.3: leaf connections could bypass Nats-Trace-Dest publish permission checks, and NoAuthUser did not enforce connection restrictions. Review permission and NoAuthUser configs after upgrading, since previously permitted traffic may now be denied as intended.

v2.12.12 is a bugfix and hardening release for nats-server, centered on numerous JetStream/Raft data-integrity and panic fixes plus removal of JSONP support from monitoring endpoints. No CVEs are disclosed, but several fixes close memory-exhaustion and panic paths reachable via malformed MQTT input that operators should treat as security-relevant.

• securityMQTT partial-CONNECT and PUBLISH-underflow crash/DoS fixes

  If you run MQTT, upgrade to fix two memory-exhaustion/panic paths: partial CONNECT packets could exhaust pre-authentication memory, and PUBLISH remaining-length underflow could panic the server. Both are exploitable by unauthenticated clients sending malformed input.

• securityInteger-overflow panics fixed in monitoring and JetStream usage tracking

  CONNZ/SUBSZ pagination previously could panic on integer overflow, and JetStream remote usage updates could panic on length integer overflow. Operators with large clusters or heavy monitoring polling should upgrade to remove these panic-inducing edge cases.

• breakingJSONP support removed from monitoring endpoints

  JSONP callback support has been removed from monitoring endpoints in v2.12.12, unconditionally. Any tooling or dashboards that rely on JSONP callbacks against /varz, /connz, or similar endpoints will break and must switch to plain JSON requests.

Strimzi 1.1.0 is a feature release adding Kafka 4.3.0 and 4.2.1 support while dropping Kafka 4.1.x, along with several capability additions. Operators should act on two breaking changes before upgrading: the entity-operator healthcheck port renames and the TLS truststore format switch in KafkaBridge and KafkaMirrorMaker2.

• breakingEntity-operator healthcheck ports renamed

  The entity-operator healthcheck port `healthcheck` has been renamed to `healthcheck-to` (topic-operator) and `healthcheck-uo` (user-operator). Any custom PodMonitor, ServiceMonitor, NetworkPolicy, or similar resources that reference the old port name must be updated before or immediately after upgrading.

• breakingKafka 4.1.x support removed

  Kafka 4.1.x is no longer supported in 1.1.0. Clusters running Kafka 4.1.x must be upgraded to 4.2.1 or 4.3.0 before moving to this Strimzi version.

• breakingTLS truststore format changed to PEM for KafkaBridge and KafkaMirrorMaker2

  KafkaBridge and KafkaMirrorMaker2 now use PEM files instead of P12/JKS for TLS authentication and truststore. Review any tooling or external systems that expect P12/JKS formats from these components.

• breakingCRD v1 only — older API versions unsupported

  CRD API versions v1beta2, v1beta1, and v1alpha1 are not supported since 1.0.0. If you have not already converted your resources to v1, do so before upgrading to 1.1.0.

Istio 1.28.9 is a security release bundling 14 Envoy CVE fixes under ISTIO-SECURITY-2026-005, with the most severe issues covering HTTP/3 DoS, decompressor memory exhaustion, and JSON parsing depth limits.

Istio 1.29.5 is a security release fixing 14 Envoy CVEs under ISTIO-SECURITY-2026-005, with several rated HIGH (DoS, crash, use-after-free). It also repairs a gateway revision-label traffic outage, an ambient ipset health-probe gap, a krt memory leak, and a multicluster controller panic.

• security14 Envoy CVEs fixed (max severity HIGH) — ISTIO-SECURITY-2026-005

  All 14 Envoy CVEs under ISTIO-SECURITY-2026-005 are fixed in 1.29.5. The highest-severity issues include an HTTP/3 QPACK decoding DoS (GHSA-p7C7-7c47-pwch), a compressed-payload inflation bypass of MaxInflateRatio (CVE-2026-48044), a %REQUESTED_SERVER_NAME% formatter crash (CVE-2026-47220), a QUIC content-length validation issue guarded by envoy.reloadable_features.quic_validate_headers_only_content_length (CVE-2026-48743), and a PROXY protocol TLV length mismatch (CVE-2026-47692). Upgrade all 1.29.x deployments to 1.29.5.

• securityOAuth2 filter padding oracle in AES-256-CBC cookie decryption (CVE-2026-47775)

  Operators using the OAuth2 filter with AES-256-CBC cookie encryption should upgrade immediately. The filter now supports AES-256-GCM with a gcm. algorithm marker; plan migration away from AES-256-CBC after upgrading.

• securityext_authz use-after-free with per-route service overrides (CVE-2026-47205)

  Clusters using ext_authz with per-route service overrides are exposed to a use-after-free crash when a downstream connection resets during an in-flight authorization check (CVE-2026-47205). Upgrade to 1.29.5 to eliminate the crash window.

• breakingJSON nesting depth limit reduced to 1000 (CVE-2026-48042)

  JSON parser nesting depth is now capped at 1000 by default (down from 10000). If any Envoy configuration relies on deeper nesting, the old limit can be restored temporarily by setting the runtime flag envoy.reloadable_features.limit_json_parser_nesting_depth to false, but plan to eliminate deep nesting.

Istio 1.30.2 is a security-plus-bugfix patch release, its main content is fixes for 14 Envoy CVEs (one high-severity HTTP/3 DoS via QPACK, others medium to high) under ISTIO-SECURITY-2026-005, alongside operator-relevant changes to pilot-agent metric merging and new AuthorizationPolicy trust-domain fields.

• security14 Envoy CVEs fixed under ISTIO-SECURITY-2026-005, several high severity

  Applies to all 1.30.x deployments. Fixed a DoS in the HTTP/3 stack via QPACK blocked decoding, plus a JSON parser change limiting nesting depth to 1000 (previously the 10K fallback is reachable only if envoy.reloadable_features.limit_json_parser_nesting_depth is set to false) and a headers-only content-length validation fix gated by envoy.reloadable_features.quic_validate_headers_only_content_length. Upgrade to 1.30.2.

• securityMultiple use-after-free and crash fixes across ext_authz, ext_proc, gRPC stats, and OAuth2 filters

  Applies when ext_authz per-route service overrides are active and a downstream connection resets mid-authorization-check (CVE-2026-47205), or when ext_proc/gRPC stats/OAuth2 filters are in use. Upgrade to close use-after-free and padding-oracle issues; the OAuth2 filter now also supports AES-256-GCM cookie encryption via a gcm. marker.

• breakingpilot-agent metric merging now rejects protobuf content type

  Applies to deployments using pilot-agent metric merging (PILOT_AGENT_MERGE_ENVOY_STATS). Allowed content types are now restricted to text/plain and application/openmetrics-text; protobuf-based scraping of merged metrics will break. Check scrape configs before upgrading.

• enhancementAuthorizationPolicy gains trust-domain matching

  Applies to AuthorizationPolicy authors who want mTLS trust-domain-based access control. New trustDomains and notTrustDomains fields on Source let policies match or exclude requests by the trust domain in the peer certificate.

Envoy v1.38.3 is a security-only release patching 15 CVEs plus one upstream wasmtime CVE. Two issues are rated critical: a TLS SAN NUL-byte auth bypass (CVE-2026-47778) and HTTP/3-to-HTTP/1 request smuggling (CVE-2026-48743); the remaining 13 are rated high, covering crashes, a zip-bomb DoS, a PKCE padding oracle, a 65 KB upstream data spillover, and a heap buffer overflow.

• securityCRITICAL: TLS SAN NUL-byte auth bypass (CVE-2026-47778)

  CVE-2026-47778 (GHSA-f8x4-rw5x-f3r7): a NUL byte embedded in a TLS SAN causes truncation during comparison, allowing an attacker to bypass certificate-based authentication. Upgrade to v1.38.3 unconditionally.

• securityCRITICAL: HTTP/3 to HTTP/1 request smuggling (CVE-2026-48743)

  CVE-2026-48743 (GHSA-8phg-2h2q-jgxf): a headers-only HTTP/3 request carrying a nonzero Content-Length can be smuggled into a downstream HTTP/1 backend. Any deployment proxying HTTP/3 to HTTP/1 is affected. Upgrade to v1.38.3.

• securityHIGH: PROXY Protocol v2 upstream data spillover (CVE-2026-47692)

  CVE-2026-47692 (GHSA-wh36-hm39-mm3r): the PROXY Protocol v2 header generator leaks "skipped" TLVs, spilling up to 65 KB of attacker-controlled data into the upstream application stream. Upgrade to v1.38.3.

• breakingIntel DLB connection balancer extension removed

  The contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) has been disabled at the Bazel build layer in v1.38.3 due to a broken source archive. Any deployment that relied on this extension must migrate to an alternative connection balancer.

• breakingTLS certificate Brotli compression now disabled by default

  The runtime guard envoy.reloadable_features.tls_certificate_compression_brotli is now disabled by default. When off, QUIC uses zlib-only certificate compression and TCP TLS performs no certificate compression. If you depended on Brotli compression for TLS certificates, re-enable this flag explicitly after upgrading.

Envoy v1.37.5 is a security-only release fixing 15 Envoy CVEs/GHSAs and one upstream dependency CVE, with severities reaching critical. Three critical issues stand out: HTTP/3-to-HTTP/1 request smuggling, TLS SAN auth bypass via embedded NUL bytes, and a PROXY Protocol v2 spillover that puts attacker-controlled data into upstream streams. All v1.37.x deployments should upgrade without delay.

• securityCritical: HTTP/3 to HTTP/1 request smuggling (CVE-2026-48743)

  CVE-2026-48743 (GHSA-8phg-2h2q-jgxf): HTTP/3 requests with headers-only and a nonzero Content-Length can smuggle requests into HTTP/1 upstream connections. Applies to any deployment terminating HTTP/3 and proxying to HTTP/1 backends. Upgrade immediately.

• securityCritical: TLS SAN NUL-byte auth bypass (CVE-2026-47778)

  CVE-2026-47778 (GHSA-f8x4-rw5x-f3r7): A TLS SAN containing an embedded NUL byte is truncated at that byte during comparison, allowing a certificate to match patterns it should not. Any deployment making auth decisions based on TLS SAN validation is affected. Upgrade immediately.

• securityCritical: PROXY Protocol v2 TLV spillover into upstream stream (CVE-2026-47692)

  CVE-2026-47692 (GHSA-wh36-hm39-mm3r): The PROXY Protocol v2 header generator emits TLVs that were supposed to be skipped, spilling up to 65 KB of attacker-controlled data into the upstream application stream. Affects deployments that generate PROXY Protocol v2 headers toward upstreams. Upgrade immediately.

• securityHigh: Two OAuth2 filter vulnerabilities (padding oracle + UAF)

  CVE-2026-47775 and CVE-2026-48090 (GHSA-396h-jpq4-vc7p, GHSA-3cj2-c63f-q26f): The OAuth2 filter has a PKCE code-verifier padding oracle and a use-after-free risk when an async token fetch completes after stream teardown. Both affect deployments using envoy.filters.http.oauth2.

• securityHigh: HTTP/3 QPACK blocked-decoding DoS (GHSA-p7c7-7c47-pwch)

  HTTP/3 QPACK blocked decoding (GHSA-p7c7-7c47-pwch) can be exploited to cause a DoS against the HTTP/3 stack. Affects any deployment serving HTTP/3.

• securityHigh: grpc_stats filter segfault on Connect protocol (CVE-2026-47204)

  CVE-2026-47204 (GHSA-3jxh-8p6x-7pf6): The grpc_stats filter segfaults on Connect-protocol requests routed to direct_response routes. Affects deployments using envoy.filters.http.grpc_stats.

• breakingIntel DLB connection balancer contrib extension disabled at build time

  The envoy.network.connection_balance.dlb contrib extension (Intel DLB connection balancer) has been disabled at the Bazel build layer across all platforms due to a source archive breakage. Deployments relying on this extension must pursue a local workaround or alternative balancing strategy until the source issue is resolved.

Envoy v1.36.9 is a security-only release patching 15 CVEs (2 rated critical, the rest high or medium) across TLS SAN handling, HTTP/3, PROXY protocol, JSON parsing, OAuth2, ext_proc, grpc_stats, zstd, DNS, and statsd. Operators should upgrade immediately, as two of the vulnerabilities -- TLS SAN auth bypass and HTTP/3 request smuggling -- are unconditional or broadly exploitable.

• securityCRITICAL: TLS SAN NUL-byte auth bypass (CVE-2026-47778 / GHSA-f8x4-rw5x-f3r7)

  A TLS SAN containing an embedded NUL byte causes the SAN to be truncated, bypassing certificate-based authentication checks. All deployments are affected. Upgrade to v1.36.9 immediately.

• securityCRITICAL: HTTP/3-to-HTTP/1 request smuggling (CVE-2026-48743 / GHSA-8phg-2h2q-jgxf)

  A headers-only HTTP/3 request with a nonzero Content-Length can be smuggled into HTTP/1 backends, enabling request smuggling attacks. Affects any deployment proxying HTTP/3 to HTTP/1 backends.

• securityHIGH: PROXY Protocol v2 upstream data spillover (CVE-2026-47692 / GHSA-wh36-hm39-mm3r)

  PROXY Protocol v2 header generation leaks up to 65 KB of attacker-controlled data into the upstream application stream via improperly emitted TLVs. Affects deployments using the PROXY Protocol v2 header generator.

• securityHIGH: Stack overflow on deeply nested JSON (CVE-2026-48042 / GHSA-f24p-rxw2-g6pv)

  Deeply nested JSON input triggers a stack overflow in the object destructor, crashing the proxy. All deployments are affected.

• securityHIGH: wasmtime dependency CVE (CVE-2026-47261)

  The wasmtime dependency was bumped to resolve CVE-2026-47261. All deployments using Wasm extensions are affected.

• breakingDLB connection balancer extension disabled (capability removed)

  The contrib Intel DLB connection balancer extension (envoy.network.connection_balance.dlb) is now disabled at the Bazel layer for all platforms due to a source archive breakage. Builds that previously enabled this extension will lose it silently.

Envoy v1.35.13 is a major security release fixing 13 CVEs, two of them critical: a PROXY protocol v2 TLV spillover leaking up to 65KB into the upstream stream, and a TLS SAN NUL-truncation bug that can bypass certificate-based auth. It also disables the contrib Intel DLB connection balancer extension due to a build breakage.

• securityPROXY Protocol v2 TLV spillover (CVE-2026-47692)

  Applies to all v1.35.13 deployments running PROXY protocol v2 header generation upstream. CVE-2026-47692 lets an attacker's "skipped" TLVs leak up to 65KB into the upstream application stream. Upgrade immediately if you use this feature.

• securityTLS SAN NUL truncation enables auth bypass (CVE-2026-47778)

  Applies to deployments validating client certificates by SAN. CVE-2026-47778 lets an embedded NUL byte in a TLS SAN truncate the parsed name, allowing certificates to match unintended hostnames and bypass authentication. Upgrade immediately.

• security11 more high-severity CVEs across core filters and HTTP/3

  Eleven additional high-severity CVEs are fixed across ext_proc, router internal redirects, OAuth2 (two separate issues: padding oracle and a use-after-free from late async token completion), zstd decompression, grpc_stats, JSON parsing, the DNS filter, HTTP/3 (content-length validation and a separate QPACK-based DoS), and TcpStatsdSync. Each is a crash, DoS, or memory-safety bug tied to a specific filter or codec; upgrade to pick up all fixes, or check which filters you run to prioritize.

• securityWasmtime dependency bump fixes CVE-2026-47261

  A separate wasmtime CVE (CVE-2026-47261) is fixed by bumping the com_github_wasmtime dependency. Applies to deployments using the Wasm filter.

• breakingIntel DLB connection balancer extension disabled

  The contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) is disabled at the Bazel build layer for all builds and platforms due to a source archive breakage. Anyone building Envoy with this extension enabled needs an alternate connection balancer.

Linkerd edge-26.6.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

Strimzi 1.0.1 patches two CVEs and disables cross-namespace Entity Operator watching by default. The v1-only CRD API requirement from 1.0.0 remains enforced — no v1beta2/v1beta1/v1alpha1.

• securityPatch two CVEs — upgrade promptly

  CVE-2026-55225 and CVE-2026-55226 are fixed in 1.0.1. Details are in the Strimzi security advisories. Given both are fixed in the same patch release, treat this as a security-motivated upgrade and prioritize it over waiting for a convenient maintenance window.

• breakingEnable cross-namespace watching explicitly if you use watchedNamespace

  If your Kafka CR's Entity Operator section has watchedNamespace set to a namespace different from the Kafka cluster's namespace, the Topic or User Operator will stop watching it after upgrading. Before or immediately after upgrading, set STRIMZI_ENTITY_OPERATOR_WATCHED_NAMESPACE_ENABLED=true in your Cluster Operator deployment. Check all Kafka CRs across namespaces — missing this will silently break topic/user reconciliation.

• breakingComplete CRD migration to v1 before upgrading

  Strimzi 1.0.1 (like 1.0.0) only accepts v1 CRDs. If you skipped the migration step when moving to 1.0.0, or if you are upgrading from an older release directly, run the CRD conversion procedure documented in the Strimzi 1.0.1 deploying guide before applying the new operator manifests. Applying the operator without converted CRDs will cause reconciliation failures.

Cilium v1.19.5 is a bugfix-heavy patch release addressing policy enforcement bugs, Gateway API panics, and load-balancer correctness issues. No CVEs, but several fixes warrant attention before upgrading.

• breakingMigrate away from `l2podAnnouncements.interface` Helm value before upgrading

  The `l2podAnnouncements.interface` Helm key was removed because it wrote a configmap entry the agent no longer reads, causing crash-loops when L2 pod announcements are enabled. Before upgrading, check your Helm values for this key and replace it with `l2podAnnouncements.interfacePattern`. Clusters using the old key will fail to start after the upgrade.

• breakingCheck CiliumEgressGatewayPolicy if you use NamespaceSelector

  A bug caused the NamespaceSelector field in CiliumEgressGatewayPolicy to be silently corrupted, making those rules ineffective. After upgrading to 1.19.5, verify that egress policies with NamespaceSelector are actually being enforced — traffic that was previously leaking may now be blocked.

• enhancementVerify ipBlock network policies if you rely on selectorless rules

  A bypass was fixed where wildcard namespace selectors could skip ipBlock rules without a pod selector. If you have CiliumNetworkPolicies using ipBlock without explicit namespace selectors, review them post-upgrade to confirm enforcement behavior matches your intent — the fix may change observed traffic patterns.

Cilium 1.18.11 is a patch release focused on stability, fixing memory leaks, socket handling crashes, and Gateway API routing bugs. No breaking changes; safe to adopt for teams running 1.18.x in production.

• securityApply patch if you see agent crashes in socket handling

  Cilium 1.18.11 fixes a nil pointer dereference in filterAndDestroySockets that could crash the agent. If you have seen sudden agent pod restarts or panic logs mentioning socket filtering, upgrade promptly. This is a stability issue that affects 1.18.10 and earlier.

• breakingVerify MTU settings on non-Cilium interfaces after upgrade

  1.18.11 changes MTU handling to skip interfaces not managed by Cilium. If your infrastructure depends on Cilium adjusting MTU on external interfaces (e.g., host-managed veth pairs), test this upgrade in a staging environment first. Mark interfaces with altname to ensure they are recognized as Cilium-owned; otherwise, MTU will not be modified.

• enhancementAdopt if running Kubernetes Gateway API with TLS routes

  This patch fixes two distinct bugs in Gateway API support: weighted backend routing for TLSRoute passthrough and mixed listener handling. If you use Gateway API with TLS termination or passthrough, this upgrade eliminates silent routing failures. No configuration changes needed; test existing Gateway API resources in a staging cluster first.

Cilium v1.17.17 is a patch release fixing CiliumNode retry logic in multipool, improving troubleshoot command output, and updating dependencies. Primarily maintenance-focused with no breaking changes.

• enhancementTest multipool deployments after upgrade

  Cilium v1.17.17 fixes a retry mechanism for CiliumNode lookups that was causing intermittent failures in multipool setups. If you run multi-pool IP allocation (multiple resource pools per cluster), test pod scheduling and IP assignment post-upgrade to confirm the fix resolves any flapping you observed.

• enhancementUse enhanced troubleshoot output for cluster diagnosis

  The troubleshoot kvstore and clustermesh commands now report more diagnostic details. When investigating kvstore or clustermesh connectivity issues, re-run these commands after upgrading—the richer output will likely surface root causes faster than before.

• enhancementCheck Envoy proxy behavior after updating to v1.37.x

  The bundled Envoy proxy jumps to v1.37.x in this patch. Review Envoy release notes for v1.37.x for any behavioral changes in HTTP/2, load balancing, or observability that might affect your traffic patterns. No action required unless you rely on specific Envoy 1.36.x behavior.

Linkerd edge-26.6.2 patches policy and profile validation bugs, tightens namespace restrictions on external workloads, and upgrades to Envoy proxy v2.357.0 with unified failure accrual tuning.

• securityProfile validation now rejects nil configs

  The nil check in profile validation closes a path to crashes on malformed configs. No immediate action needed, but if your automation generates profiles programmatically, ensure they always have valid structure before applying them.

• breakingNamespace-restricted external workloads may affect routing

  External workloads and endpoints now honor namespace boundaries. If you cross namespaces with external workloads in your Linkerd setup, verify routing still works after upgrade. Update any policies that rely on previous (unrestricted) cross-namespace access.

• enhancementTune load balancing with unified failure accrual

  Unified failure accrual and response-penalty load biasing gives you finer control over how proxies handle slow or failing endpoints. Test this in a canary namespace first—adjust failure thresholds and penalty weights to match your SLOs. Check Linkerd docs for new policy knobs.

Envoy v1.38.2 is a small patch release: one RTDS runtime bug fix and two opt-in HTTP/2 cookie observability features. No security fixes.

• breakingRTDS runtime guard fix changes delete behavior — verify your override logic

  If your config management deletes RTDS runtime guard overrides expecting them to revert to default, prior behavior was broken and left stale values. After upgrading to v1.38.2, deletes will now correctly restore defaults. Test any automation that removes runtime overrides to confirm it behaves as intended.

• enhancementUse new HTTP/2 cookie size limit to guard against oversized headers

  The new envoy.reloadable_features.http2_max_cookies_size_in_kb flag lets you cap the reassembled cookie header size in HTTP/2. If your deployment handles untrusted upstream or downstream traffic with large cookie headers, set an explicit limit to reduce memory pressure. The default is unlimited, so this is opt-in.

Envoy v1.37.4 is a small patch with one RTDS bug fix and two opt-in HTTP/2 cookie-related observability/safety features. No security CVEs.

• breakingRTDS override deletion behavior changed — verify runtime guard state

  If your deployments rely on RTDS to manage runtime guard overrides, the old behavior left stale override values after deletion. The fix now restores the process-wide default. Check that your expected default values are actually what you want after an override is removed, especially if you were working around the old broken behavior.

• enhancementUse the new cookie size limit to protect against oversized cookie headers

  HTTP/2 reassembled cookie headers had no size cap before this release. If you proxy untrusted HTTP/2 clients, set envoy.reloadable_features.http2_max_cookies_size_in_kb to a reasonable limit (e.g., 32–64 KB) to prevent unexpectedly large cookie payloads from reaching upstreams. The default remains unlimited, so this requires an explicit opt-in.

• enhancementEnable HTTP/2 header histograms in staging to baseline your traffic

  The new envoy.reloadable_features.http2_record_histograms flag adds histograms for header count, map byte size, and cookie metrics. These are useful for understanding HTTP/2 header pressure in your fleet. Enable in a non-production environment first — note these metrics will be removed in a future Envoy release, so don't build long-term dashboards around them.

Envoy v1.36.8 is a minor patch with one bug fix and two opt-in HTTP/2 observability features. No breaking changes or CVEs.

• breakingHTTP/2 header histograms are temporary — don't build dashboards on them

  The new http2_record_histograms feature and its runtime guard are explicitly scheduled for removal in a future Envoy release. If you enable them for debugging HTTP/2 header issues, treat the resulting metrics as short-lived. Don't wire them into permanent dashboards or alerts that would break on upgrade.

• enhancementEnable HTTP/2 header histograms if you're debugging large header or cookie payloads

  If you're seeing unexpectedly large HTTP/2 requests or cookie-related issues, flip envoy.reloadable_features.http2_record_histograms to get histograms on header entry count, byte size, and cookie metrics. Pair this with envoy.reloadable_features.http2_max_cookies_size_in_kb to enforce a hard cap on reassembled cookie header size — useful if you need to protect upstream services from oversized cookie headers.

Envoy v1.35.12 is a minor patch with one runtime bug fix and two opt-in HTTP/2 cookie/header observability features. No breaking changes or CVEs.

• breakingRTDS override deletion behavior changed — verify runtime guard defaults

  If you rely on RTDS to manage runtime guard overrides, test this fix in staging. Previously, deleting an override left the old value active; now it resets to the process default. Any automation that deleted overrides expecting them to persist will behave differently.

• enhancementUse the new HTTP/2 cookie size limit to guard against oversized cookie headers

  The new envoy.reloadable_features.http2_max_cookies_size_in_kb flag is off by default. If your deployments accept untrusted HTTP/2 traffic, consider setting a reasonable limit to bound memory usage from reassembled cookie headers. Pair it with the new histograms to first measure your actual cookie sizes before choosing a cap.

NATS v2.12.11 is a single-fix patch release targeting a JetStream regression in v2.12.7 that caused stale subject state tracking and 'Message Not Found' errors on streams with per-subject message limits.

• breakingUpgrade if you use max-messages-per-subject on any stream

  If you run NATS 2.12.7–2.12.10 and have streams configured with MaxMsgsPerSubject (max_msgs_per_subject), you are exposed to silent stale-state bugs that surface as 'Message Not Found' errors. These errors can cause consumers to miss messages or behave unpredictably. Upgrade to 2.12.11 immediately. If you are already on 2.14.x, you are not affected and no action is needed.

gRPC v1.81.1 is a patch release fixing memory safety bugs on Windows and ARM, plus Python/Ruby housekeeping. No API-breaking changes.

• breakingPython 3.9 and Ruby 3.1 are no longer supported

  If your services run gRPC Python on 3.9 or Ruby on 3.1, upgrading to v1.81.1 will break your build. Check your runtime versions before upgrading. Python 3.10+ and Ruby 3.2+ are the minimum now.

• enhancementUpgrade Windows/ARM deployments to get memory safety fixes

  Two Windows EventEngine races and an ARM completion queue shutdown race are fixed. If you run gRPC servers on Windows or ARM-based hosts (e.g., Graviton), this patch is worth applying — use-after-free and assertion crashes are hard to reproduce but can cause random service failures.

• enhancementprotobuf 7.x now allowed for gRPC Python

  The grpc-status package previously capped protobuf at <6.x. With the upper bound relaxed to 7.x, you can now unpin protobuf in Python services that use grpc-status alongside other libraries requiring newer protobuf versions.

Mostly a dependency maintenance release with two proxy bumps (v2.355.0, v2.356.0) and a fix for ReadAllLimit byte boundary handling.

• enhancementTwo proxy versions in one release — check proxy changelogs separately

  This edge release packages proxy v2.355.0 and v2.356.0 together, meaning two rounds of proxy changes landed at once. If you track proxy behavior closely (traffic policy, retries, protocol detection), pull the proxy-specific changelogs before rolling this out to staging. The combined nature makes it harder to bisect if you hit regressions.

• enhancementReadAllLimit fix may affect request body handling edge cases

  The ReadAllLimit fix allows inputs that hit the exact byte boundary to pass through correctly. If you have services where request bodies are crafted to exactly match a configured limit — common in API gateways or body-size validation scenarios — this corrects previously incorrect rejection behavior. No config changes needed, but worth validating if you saw unexpected 413-style rejections.

Istio 1.29.4 patches a high-severity DoS CVE in Envoy plus six bug fixes, including a critical ambient mode traffic routing bug that could silently send traffic to unhealthy endpoints cluster-wide.

• securityPatch CVE-2026-47774 immediately — unauthenticated HTTP/2 DoS

  CVE-2026-47774 lets any unauthenticated attacker exhaust Envoy's memory via crafted HTTP/2 requests. Cookie header bytes aren't fully counted in header size validation, and HPACK limits apply only to encoded bytes — not decoded totals. If you're on 1.29.x, upgrade to 1.29.4 now. This is exploitable from outside the mesh wherever Envoy terminates HTTP/2, including ingress gateways.

• breakingAmbient mode users: audit Services using publishNotReadyAddresses + traffic distribution

  If any Service in your ambient mesh combines publishNotReadyAddresses:true with PreferSameZone or PreferSameNode traffic distribution, every other Service sharing that traffic-distribution preset was receiving healthPolicy:AllowAll — meaning traffic could route to not-ready endpoints across the entire cluster. After upgrading to 1.29.4, verify endpoint health policies are correct. Check ztunnel logs for unexpected AllowAll entries before and after the upgrade to confirm the fix took effect.

• enhancementCNI on older kernels: nftables fallback now automatic

  Hosts running an nft binary compiled without JSON support were causing the CNI agent to log errors and retry indefinitely on every pod removal — a silent drain on the agent's reliability. The new startup check detects this and switches to iptables automatically. No action needed for most users, but if you've been seeing 'JSON support not compiled-in' errors in CNI agent logs, this fix resolves the root cause.

Istio 1.28.8 patches a high-severity DoS CVE in Envoy's HTTP/2 memory handling, plus three bug fixes covering TLS delivery, route filter status reporting, and a nasty ambient mode health policy contamination bug.

• securityPatch CVE-2026-47774 immediately if you expose HTTP/2 endpoints

  An unauthenticated attacker can crash your Envoy sidecars by sending specially crafted HTTP/2 requests that bypass header size validation — cookie bytes aren't counted properly, and HPACK limits apply only to encoded size, not decoded. Any cluster accepting external or untrusted HTTP/2 traffic is at risk. Upgrade to 1.28.8 now. If you can't upgrade immediately, consider adding Envoy-level request header size limits or WAF rules to filter malformed HTTP/2 frames as a temporary measure.

• breakingAudit ambient mode clusters using publishNotReadyAddresses with zonal traffic distribution

  If you run ambient mode and any Service sets publishNotReadyAddresses:true alongside PreferSameZone or PreferSameNode, you've likely been routing traffic to not-ready endpoints across your entire cluster — not just for that Service, but for every Service sharing the same traffic-distribution preset. This is a silent data-plane correctness bug. After upgrading, verify endpoint health behavior across affected Services and check whether any downstream systems received traffic from unhealthy pods during the window this was active.

• enhancementFix for silent route filter drops enables reliable config debugging

  Previously, HTTPRoute or GRPCRoute filters with invalid header values would vanish from Envoy config without any status signal — making it nearly impossible to diagnose why traffic wasn't behaving as expected. Now Istio reports an invalid filter status, which surfaces in the Gateway API resource status. After upgrading, re-check any routes you may have debugged by guesswork; the explicit status message will clarify whether a header filter was rejected.

Istio 1.30.1 patches a high-severity DoS CVE in Envoy's HTTP/2 handling plus fixes 13 bugs including a CNI agent panic, a traffic distribution poison bug, and a consistent hash load balancing regression.

• securityPatch CVE-2026-47774 immediately — unauthenticated HTTP/2 DoS

  An attacker can exhaust Envoy's memory using crafted HTTP/2 requests that exploit gaps in Cookie header accounting and HPACK decoded-size limits. No authentication required. If you're running any Istio 1.30.x version, upgrade to 1.30.1 now. Check whether your ingress gateways are exposed to untrusted traffic — those are the highest-risk surfaces.

• breakingAmbient users with traffic distribution policies: audit Services immediately

  If you use ambient mode with any Service that sets publishNotReadyAddresses: true alongside PreferSameZone or PreferSameNode traffic distribution, the bug caused ztunnel to apply healthPolicy: AllowAll to OTHER unrelated Services sharing that preset. This means traffic has potentially been routed to not-ready endpoints across your cluster. After upgrading to 1.30.1, verify endpoint health state and check whether any unexpected traffic reached unready pods.

• enhancementRun 'istioctl analyze' after upgrading to catch stale Gateway API CRDs

  Upgrading Istio without updating Gateway API CRDs was silently breaking TLS passthrough in 1.30.0 — istiod would filter resources without any visible error. The new IST0176 check surfaces this. After upgrading, run istioctl analyze and resolve any IST0176 findings before they cause silent routing failures in production.

v1.38.1 is a security-focused patch addressing two HTTP/2 CVEs and two oauth2 vulnerabilities — upgrade immediately if running HTTP/2 or oauth2 filter.

• securityPatch HTTP/2 and oauth2 CVEs now — don't wait for your next maintenance window

  Two HTTP/2 CVEs (cookie-bomb memory exhaustion via HPACK and nghttp2 CVE-2026-27135) plus two oauth2 bugs (timing oracle and a crash-as-auth-bypass) make this a must-apply patch. If you're running the oauth2 filter, the HMAC timing side-channel is particularly nasty — attackers could probe HMAC secret validity over time. Upgrade to v1.38.1 immediately. The new HTTP/2 header limit behavior is enabled by default; only revert with `envoy.reloadable_features.http2_include_cookies_in_limits` if you have a specific, documented reason.

• breakingUpstream failure reason stripped from HTTP response bodies — check your client error handling

  Any downstream client or API consumer that parses or displays the upstream transport failure reason from the HTTP response body will now get nothing. The information is still in access logs. Audit your clients and dashboards before upgrading — if something depends on that response body content, you have a short window to either update the client or re-enable the old behavior with `envoy.reloadable_features.hide_transport_failure_reason_in_response_body`.

• breakingEDS batch LB rebuild coalescing is now opt-in — test under high-churn service discovery

  Load balancer rebuild coalescing during EDS batch host updates is disabled by default. Environments with large EDS clusters and frequent host churn (e.g., Kubernetes rolling deployments with many pods) may see increased CPU from more frequent LB rebuilds. Benchmark your control-plane interaction patterns after upgrading. Re-enable the old behavior with `envoy.reloadable_features.coalesce_lb_rebuilds_on_batch_update` if you observe performance regression.

v1.37.3 is a security-focused patch fixing two HTTP/2 CVEs and oauth2 vulnerabilities — upgrade immediately if you use HTTP/2 or oauth2 filter.

• securityPatch HTTP/2 deployments now for CVE-2026-47774 and CVE-2026-27135

  Two HTTP/2 CVEs are fixed in this release. CVE-2026-47774 enables a cookie-bomb attack that causes excessive memory usage by sending large numbers of cookies that bypass header size limits before this fix. CVE-2026-27135 is an nghttp2-level vulnerability. If you terminate HTTP/2 traffic, upgrade to v1.37.3 immediately. The new cookie-counting behavior is enabled by default; if it causes regressions, you can temporarily disable it with the feature flag `envoy.reloadable_features.http2_include_cookies_in_limits`, but treat that as a short-term workaround only.

• securityRotate oauth2 HMAC secrets after upgrading

  The timing side-channel in HMAC verification means a patient attacker could have probed whether a given secret was valid. After upgrading, rotate your oauth2 HMAC secrets as a precaution — especially in internet-facing deployments. The AES-CBC crash fix is also relevant: the previous 1/256 spurious decryption success could cause unpredictable auth behavior, not just crashes.

• breakingCookie-heavy workloads may see HTTP/2 stream resets

  The CVE-2026-47774 fix changes how cookies are counted against `mutable_max_request_headers_kb` and `max_headers_count`. Clients sending many cookies that were previously accepted may now hit limits and receive stream resets. Test your high-cookie traffic patterns in staging before rolling this to production, and review your header size limits to ensure they are set appropriately for your workloads.

v1.36.7 is a security-focused patch addressing two CVEs in HTTP/2 and an HPACK cookie-bomb attack vector in the oauth2 filter, plus a crash fix. Upgrade immediately.

• securityPatch HTTP/2 CVEs now — two CVEs affect any HTTP/2-exposed Envoy

  CVE-2026-47774 enables a cookie-bomb attack where crafted HPACK-compressed cookies inflate to exhaust Envoy memory. After patching, cookies count toward `mutable_max_request_headers_kb` and `max_headers_count`. If you see legitimate requests being reset post-upgrade, the escape hatch is the `envoy.reloadable_features.http2_include_cookies_in_limits` flag — but audit your header size limits first rather than disabling the protection. CVE-2026-27135 is an nghttp2-layer fix with no workaround; you must upgrade.

• securityAudit oauth2 filter deployments for timing and decryption exposure

  Two oauth2 bugs fixed here are subtle but serious. The timing side-channel in HMAC verification could allow an attacker to probe secret validity over many requests. The AES-CBC crash (1/256 chance on bad tokens) is a reliability issue that could be triggered deliberately. If you use the oauth2 filter with token cookies, treat this as a high-priority upgrade — there's no configuration workaround for either issue.

• breakingReview header size limits before deploying — cookie counting is a behavior change

  Cookies previously excluded from header size accounting now count toward limits. In practice, applications with many or large cookies may hit `max_headers_count` or `mutable_max_request_headers_kb` and get HTTP/2 stream resets where they didn't before. Before rolling out, check your current limit configurations against real traffic cookie sizes. If you need time, the reloadable feature flag lets you defer the behavior change, but don't leave it disabled long-term.

v1.35.11 is a security-focused patch fixing two HTTP/2 CVEs and two oauth2 vulnerabilities — upgrade immediately if you're running HTTP/2 or oauth2 filter.

• securityPatch HTTP/2 HPACK cookie-bomb vulnerability now

  CVE-2026-47774 allows an attacker to craft requests with large numbers of HPACK-compressed cookies that decompress into massive header payloads, causing excessive memory usage. The fix resets offending streams and counts cookies toward existing header size limits. Roll out this patch to any Envoy instance terminating HTTP/2 traffic. If you hit legitimate regressions with cookie-heavy workloads, the flag `envoy.reloadable_features.http2_include_cookies_in_limits` can temporarily revert the behavior — but treat that as a short-term workaround, not a solution.

• securityUpgrade if you use the oauth2 filter — two separate fixes here

  There are two distinct oauth2 issues fixed: a timing side-channel in HMAC verification (exploitable via repeated probing to determine secret validity) and a crash from incorrect AES-CBC decryption behavior on secret mismatch. The crash was probabilistic (~1/256 per request) but real. If your deployment uses Envoy's built-in oauth2 filter for token validation, this patch directly reduces both crash risk and secret exposure surface.

• enhancementEvaluate stats eviction for high-cardinality metric environments

  The new `stats_eviction_interval` config allows Envoy to periodically purge unused metrics from memory. If you're running workloads with dynamic or high-cardinality labels (e.g., per-request or per-user stats), this can meaningfully reduce memory footprint over time. Test in staging first — eviction behavior depends on whether extensions implement the evictable metrics interface, so not all metrics will be affected.

NATS v2.14.2 is a focused stability release fixing multiple JetStream data integrity issues, lock release bugs, and protocol corruption risks — upgrade if you run JetStream at any meaningful scale.

• securityProtocol corruption vectors closed — critical for WebSocket and JetStream users

  Two protocol corruption bugs were fixed: one in $JS.ACK subject rewriting and one in compressed WebSocket client buffer handling. Either could produce malformed frames that corrupt stream state or client sessions. If you expose NATS WebSocket endpoints or rely heavily on JetStream ACKs, treat this as a security-adjacent stability issue and prioritize the upgrade.

• breakingTwo separate lock-release bugs can cause silent hangs — patch now

  Both the filestore and consumer code paths had cases where locks were never released after specific error conditions (write errors and start sequence errors). In production this means stuck consumers or hung filestore operations that don't recover without a restart. If you've seen unexplained JetStream stalls, this is likely why. Upgrade to v2.14.2 immediately.

• enhancementHigh subject-count streams no longer risk CPU spikes — no config change needed

  The filestore block skip check was triggering runaway CPU on streams with very high subject counts. The fix is automatic after upgrade — no configuration changes required. If you've been working around this with stream design compromises (e.g., artificially limiting subjects per stream), you can revisit those decisions after upgrading.

v2.12.10 is a focused bug-fix release addressing protocol corruption risks, JetStream Raft/quorum issues, and a CPU runaway bug in high-cardinality streams.

• securityUpdate x/crypto and nkeys immediately

  This release bumps golang.org/x/crypto to v0.52.0 and nkeys to v0.4.16. These libraries handle cryptographic operations in NATS auth flows. Don't wait for scheduled maintenance — patch now, especially if your clusters are internet-exposed or use decentralized auth.

• breakingProtocol corruption fixes require prompt upgrade for WebSocket and JetStream users

  Two separate protocol-level corruption bugs are fixed here: one in compressed WebSocket clients, one in $JS.ACK subject rewriting. Either can silently corrupt message framing. If you run WebSocket clients or any JetStream workload with acknowledgements, staying on 2.12.9 or earlier is a real risk. Upgrade servers first, then clients.

• enhancementHigh-cardinality JetStream streams get a CPU safety fix — verify your config

  The block skip check on streams with very high subject counts could cause runaway CPU. That check is now disabled for those cases. If you've been seeing unexpected CPU spikes on JetStream nodes with streams containing millions of subjects, this is likely the culprit. After upgrading, also review Counter stream and message schedule configs — new constraints are enforced that may reject previously accepted but incorrect configurations.

Linkerd edge-26.5.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Linkerd edge-26.5.4 was released, but the published notes are too brief to summarize. See the original release notes for details.

gRPC v1.81.0 drops Python 3.9 and Ruby 3.1 support, fixes crash-level races on Windows and ARM, and adds AsyncIO observability for Python.

• breakingPython 3.9 support dropped — check your runtime

  gRPC Python 1.81.0 drops Python 3.9 support. If your services still run on Python 3.9, stay on an older gRPC release until you can upgrade your runtime. Plan the Python version bump before pulling this release.

• breakingRuby 3.1 support dropped — upgrade your Ruby runtime

  Ruby 3.1 has reached EOL and gRPC 1.81.0 drops support for it. If you're running Ruby 3.1 in production with gRPC, you'll need to upgrade to Ruby 3.2+ before adopting this release.

• enhancementWindows and ARM stability fixes worth taking

  Two EventEngine fixes address a use-after-free and a race condition causing assertion errors on Windows, plus a completion queue shutdown race on ARM (weak memory model). If you run gRPC on Windows or ARM-based infrastructure, this release directly fixes stability issues that could cause crashes. Upgrade when stable.

Contour v1.33.5 is a security patch: it closes a JWT verification bypass that was possible when fallback certificates were combined with JWT-protected HTTPProxy routes.

Linkerd edge-26.5.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

NATS v2.14.1 is a substantial patch release fixing ~30 bugs across JetStream, clustering, and core messaging — several of them data-integrity and panic-level issues worth deploying promptly.

• securitygolang.org/x/crypto bumped to v0.51.0 — update now if you embed nats-server

  The x/crypto and x/sys dependency updates often carry CVE fixes. If you embed nats-server as a Go library (common in edge/IoT deployments), rebuild and redeploy. For standard deployments, just upgrade the binary. Don't sit on this one — crypto library updates in a messaging server are not optional hygiene.

• breakingReview the 2.14 Upgrade Guide before deploying — 2.13.x was skipped

  The release notes explicitly reference backwards-compatibility notes against 2.12.x, not 2.13.x, because that minor version was never released. If your team is running 2.12.x and skipped 2.13.x, read the 2.14 upgrade guide carefully before rolling out. Pay attention to JetStream consumer and stream API changes that may affect your clients.

• enhancementUse the new client-traffic /varz metrics for baseline observability

  The four new metrics (in/out client msgs/bytes) give you a cleaner split between client traffic and internal cluster/leafnode chatter. Wire these into your Prometheus scrape or monitoring dashboard now to establish baselines. This is especially useful for capacity planning on servers that handle mixed client and cluster traffic, since previously you had to infer client load from total metrics.