リリース

Istio 1.28.10は単一のバグ修正を含むルーティンパッチです。krtコントローラフレームワークで、Fetchフィルターのキー変更時に古い逆引きインデックスエントリが残り続けるメモリリークを修正しました。

Istio 1.28.9 is a security release bundling 14 Envoy CVE fixes under ISTIO-SECURITY-2026-005, with the most severe issues covering HTTP/3 DoS, decompressor memory exhaustion, and JSON parsing depth limits.

Istio 1.29.5 is a security release fixing 14 Envoy CVEs under ISTIO-SECURITY-2026-005, with several rated HIGH (DoS, crash, use-after-free). It also repairs a gateway revision-label traffic outage, an ambient ipset health-probe gap, a krt memory leak, and a multicluster controller panic.

• security14 Envoy CVEs fixed (max severity HIGH) — ISTIO-SECURITY-2026-005

  All 14 Envoy CVEs under ISTIO-SECURITY-2026-005 are fixed in 1.29.5. The highest-severity issues include an HTTP/3 QPACK decoding DoS (GHSA-p7C7-7c47-pwch), a compressed-payload inflation bypass of MaxInflateRatio (CVE-2026-48044), a %REQUESTED_SERVER_NAME% formatter crash (CVE-2026-47220), a QUIC content-length validation issue guarded by envoy.reloadable_features.quic_validate_headers_only_content_length (CVE-2026-48743), and a PROXY protocol TLV length mismatch (CVE-2026-47692). Upgrade all 1.29.x deployments to 1.29.5.

• securityOAuth2 filter padding oracle in AES-256-CBC cookie decryption (CVE-2026-47775)

  Operators using the OAuth2 filter with AES-256-CBC cookie encryption should upgrade immediately. The filter now supports AES-256-GCM with a gcm. algorithm marker; plan migration away from AES-256-CBC after upgrading.

• securityext_authz use-after-free with per-route service overrides (CVE-2026-47205)

  Clusters using ext_authz with per-route service overrides are exposed to a use-after-free crash when a downstream connection resets during an in-flight authorization check (CVE-2026-47205). Upgrade to 1.29.5 to eliminate the crash window.

• breakingJSON nesting depth limit reduced to 1000 (CVE-2026-48042)

  JSON parser nesting depth is now capped at 1000 by default (down from 10000). If any Envoy configuration relies on deeper nesting, the old limit can be restored temporarily by setting the runtime flag envoy.reloadable_features.limit_json_parser_nesting_depth to false, but plan to eliminate deep nesting.

Istio 1.30.2 is a security-plus-bugfix patch release, its main content is fixes for 14 Envoy CVEs (one high-severity HTTP/3 DoS via QPACK, others medium to high) under ISTIO-SECURITY-2026-005, alongside operator-relevant changes to pilot-agent metric merging and new AuthorizationPolicy trust-domain fields.

• security14 Envoy CVEs fixed under ISTIO-SECURITY-2026-005, several high severity

  Applies to all 1.30.x deployments. Fixed a DoS in the HTTP/3 stack via QPACK blocked decoding, plus a JSON parser change limiting nesting depth to 1000 (previously the 10K fallback is reachable only if envoy.reloadable_features.limit_json_parser_nesting_depth is set to false) and a headers-only content-length validation fix gated by envoy.reloadable_features.quic_validate_headers_only_content_length. Upgrade to 1.30.2.

• securityMultiple use-after-free and crash fixes across ext_authz, ext_proc, gRPC stats, and OAuth2 filters

  Applies when ext_authz per-route service overrides are active and a downstream connection resets mid-authorization-check (CVE-2026-47205), or when ext_proc/gRPC stats/OAuth2 filters are in use. Upgrade to close use-after-free and padding-oracle issues; the OAuth2 filter now also supports AES-256-GCM cookie encryption via a gcm. marker.

• breakingpilot-agent metric merging now rejects protobuf content type

  Applies to deployments using pilot-agent metric merging (PILOT_AGENT_MERGE_ENVOY_STATS). Allowed content types are now restricted to text/plain and application/openmetrics-text; protobuf-based scraping of merged metrics will break. Check scrape configs before upgrading.

• enhancementAuthorizationPolicy gains trust-domain matching

  Applies to AuthorizationPolicy authors who want mTLS trust-domain-based access control. New trustDomains and notTrustDomains fields on Source let policies match or exclude requests by the trust domain in the peer certificate.

Istio 1.29.4 patches a high-severity DoS CVE in Envoy plus six bug fixes, including a critical ambient mode traffic routing bug that could silently send traffic to unhealthy endpoints cluster-wide.

• securityPatch CVE-2026-47774 immediately — unauthenticated HTTP/2 DoS

  CVE-2026-47774 lets any unauthenticated attacker exhaust Envoy's memory via crafted HTTP/2 requests. Cookie header bytes aren't fully counted in header size validation, and HPACK limits apply only to encoded bytes — not decoded totals. If you're on 1.29.x, upgrade to 1.29.4 now. This is exploitable from outside the mesh wherever Envoy terminates HTTP/2, including ingress gateways.

• breakingAmbient mode users: audit Services using publishNotReadyAddresses + traffic distribution

  If any Service in your ambient mesh combines publishNotReadyAddresses:true with PreferSameZone or PreferSameNode traffic distribution, every other Service sharing that traffic-distribution preset was receiving healthPolicy:AllowAll — meaning traffic could route to not-ready endpoints across the entire cluster. After upgrading to 1.29.4, verify endpoint health policies are correct. Check ztunnel logs for unexpected AllowAll entries before and after the upgrade to confirm the fix took effect.

• enhancementCNI on older kernels: nftables fallback now automatic

  Hosts running an nft binary compiled without JSON support were causing the CNI agent to log errors and retry indefinitely on every pod removal — a silent drain on the agent's reliability. The new startup check detects this and switches to iptables automatically. No action needed for most users, but if you've been seeing 'JSON support not compiled-in' errors in CNI agent logs, this fix resolves the root cause.

Istio 1.28.8 patches a high-severity DoS CVE in Envoy's HTTP/2 memory handling, plus three bug fixes covering TLS delivery, route filter status reporting, and a nasty ambient mode health policy contamination bug.

• securityPatch CVE-2026-47774 immediately if you expose HTTP/2 endpoints

  An unauthenticated attacker can crash your Envoy sidecars by sending specially crafted HTTP/2 requests that bypass header size validation — cookie bytes aren't counted properly, and HPACK limits apply only to encoded size, not decoded. Any cluster accepting external or untrusted HTTP/2 traffic is at risk. Upgrade to 1.28.8 now. If you can't upgrade immediately, consider adding Envoy-level request header size limits or WAF rules to filter malformed HTTP/2 frames as a temporary measure.

• breakingAudit ambient mode clusters using publishNotReadyAddresses with zonal traffic distribution

  If you run ambient mode and any Service sets publishNotReadyAddresses:true alongside PreferSameZone or PreferSameNode, you've likely been routing traffic to not-ready endpoints across your entire cluster — not just for that Service, but for every Service sharing the same traffic-distribution preset. This is a silent data-plane correctness bug. After upgrading, verify endpoint health behavior across affected Services and check whether any downstream systems received traffic from unhealthy pods during the window this was active.

• enhancementFix for silent route filter drops enables reliable config debugging

  Previously, HTTPRoute or GRPCRoute filters with invalid header values would vanish from Envoy config without any status signal — making it nearly impossible to diagnose why traffic wasn't behaving as expected. Now Istio reports an invalid filter status, which surfaces in the Gateway API resource status. After upgrading, re-check any routes you may have debugged by guesswork; the explicit status message will clarify whether a header filter was rejected.

Istio 1.30.1 patches a high-severity DoS CVE in Envoy's HTTP/2 handling plus fixes 13 bugs including a CNI agent panic, a traffic distribution poison bug, and a consistent hash load balancing regression.

• securityPatch CVE-2026-47774 immediately — unauthenticated HTTP/2 DoS

  An attacker can exhaust Envoy's memory using crafted HTTP/2 requests that exploit gaps in Cookie header accounting and HPACK decoded-size limits. No authentication required. If you're running any Istio 1.30.x version, upgrade to 1.30.1 now. Check whether your ingress gateways are exposed to untrusted traffic — those are the highest-risk surfaces.

• breakingAmbient users with traffic distribution policies: audit Services immediately

  If you use ambient mode with any Service that sets publishNotReadyAddresses: true alongside PreferSameZone or PreferSameNode traffic distribution, the bug caused ztunnel to apply healthPolicy: AllowAll to OTHER unrelated Services sharing that preset. This means traffic has potentially been routed to not-ready endpoints across your cluster. After upgrading to 1.30.1, verify endpoint health state and check whether any unexpected traffic reached unready pods.

• enhancementRun 'istioctl analyze' after upgrading to catch stale Gateway API CRDs

  Upgrading Istio without updating Gateway API CRDs was silently breaking TLS passthrough in 1.30.0 — istiod would filter resources without any visible error. The new IST0176 check surfaces this. After upgrading, run istioctl analyze and resolve any IST0176 findings before they cause silent routing failures in production.

Istio 1.30 ships experimental AI-focused agentgateway, ambient mode CIDR support, a new TrafficExtension API, and tightened debug endpoint auth that breaks existing setups.

• breakingDebug endpoint auth is on by default — audit your tooling now

  Port 15010 XDS debug endpoints now enforce authentication with ENABLE_DEBUG_ENDPOINT_AUTH=true as the default. Any internal tooling, dashboards, or scripts hitting syncz or config_dump without credentials will start failing after upgrade. Before upgrading, inventory everything that talks to port 15010 and either add auth or explicitly allowlist namespaces via DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES.

• breakingStart migrating off WasmPlugin to TrafficExtension API

  TrafficExtension is now the primary extensibility API, replacing WasmPlugin. WasmPlugin isn't being removed immediately, but new features will land in TrafficExtension first. If you run Wasm extensions in production, plan a migration window and test TrafficExtension parity before 1.31 hardens the deprecation.

• enhancementUse CIDR ServiceEntry in ambient mode to simplify external IP routing

  Previously, ambient mode required enumerating individual IP endpoints in ServiceEntry. CIDR support means you can now cover entire subnets — useful for external databases, on-prem services, or shared infrastructure with dynamic IPs. If you've been maintaining large lists of individual endpoints, consolidate them now and reduce operational overhead.

Istio 1.29.3 patches two security vulnerabilities — an AuthorizationPolicy bypass and a cross-namespace XDS config leak — alongside a multicluster deadlock fix and AWS EKS ambient mesh probe fix.

• securityAudit AuthorizationPolicy rules using suffix-match principals or namespace selectors — patch immediately

  Regex metacharacters (., [, etc.) in source.principals and source.namespaces were embedded into Envoy SafeRegex unescaped. This means a policy allowing 'spiffe://cluster.local/ns/foo/sa/bar.admin' could inadvertently also match 'spiffe://cluster.local/ns/foo/sa/barXadmin'. Any service with suffix-based wildcard principal matching is potentially affected. Upgrade to 1.29.3 and review policies where principals or namespace values contain dots, brackets, or other regex metacharacters.

• securityRotate access controls on XDS debug endpoints — any authenticated workload could read cross-namespace configs

  The /debug/syncz and /debug/config_dump endpoints served by StatusGen had no namespace boundary enforcement. An authenticated workload in namespace A could enumerate and read Envoy configs of workloads in namespace B. If you run multi-tenant clusters or expose istiod debug endpoints, assume cross-namespace config data may have been accessible. Upgrade immediately and audit who has accessed these endpoints via your API server audit logs.

• breakingMulti-cluster operators: the secret controller deadlock fix may change behavior during cluster updates

  The deadlock in the multicluster secret controller was triggered during remote cluster updates. If your control plane has been experiencing hangs or stalls in multi-cluster scenarios, this fix resolves the root cause — but test your cluster join/leave workflows after upgrading to confirm expected behavior is restored.

Istio 1.28.7 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.29.2 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.28.6 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.27.9 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.29.1 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.28.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Istio 1.27.8 was released, but the published notes are too brief to summarize. See the original release notes for details.