# Istio 1.29.10

> Networking & Messaging · 2026-10-22

A security release removes trust in compromised eMudhra certificate authorities and updates certificate validation in `ztunnel`. Istio 1.29 does not contain the Go fix for `CVE-2026-111943`; that fix is available in Istio 1.30.7 and 1.31.3.

## Check if affected
- **[security]** Istio 1.29 end of life
  - Applies if Istio 1.29 runs.
  - Istio 1.29 reached end of life on October 15, 2026. This release includes the end-of-life status under `ISTIO-SECURITY-2026-008`.
- **[security]** Trust in compromised eMudhra intermediate CA certificates, removed
  - Applies if you use `ubuntu`-based images or `distroless` images.
  - Trust in the compromised eMudhra intermediate CA certificates was removed. The CA bundle in `ubuntu`-based and `distroless` images no longer includes `emSign ECC Root CA - G3`, as covered by `ISTIO-SECURITY-2026-008`.
- **[security]** The `rustls-webpki` version in `ztunnel`, updated
  - Applies if `ztunnel` runs.
  - `rustls-webpki` in `ztunnel` was updated to `0.103.16`. It rejects certificate chains containing any of the compromised eMudhra intermediate keys, as covered by `ISTIO-SECURITY-2026-008`.
- **[security]** The Go fix for `CVE-2026-111943`, absent from Istio 1.29
  - Applies if Istio 1.29 runs.
  - Istio 1.29 does not include the Go fix for `CVE-2026-111943` because it is built with Go 1.25, which no longer receives fixes. `istiod`, `istioctl`, and `pilot-agent` rely on the updated CA bundle only; Istio 1.30.7 or 1.31.3 includes the Go fix.

[Full analysis](https://ratatosk.io/en/releases/istio/1.29.10)

[Original release notes](https://github.com/istio/istio/releases/tag/1.29.10)