# Istio 1.29.7

> Networking & Messaging · 2026-08-27

A security-focused maintenance release with fixes across Envoy and Istio, including authorization, request handling, and default behavior changes. It also contains correctness and performance fixes, an updated `nftables` version in Istio distroless images, and improvements for ambient and gateway operation.

## Action needed
- **[security]** URL normalization for parameterized dot path segments, fixed (`CVE-2026-73551`)
  - This release fixes URL normalization for dot and dot-dot path segments with parameters. Advisory: `CVE-2026-73551`.
- **[security]** Path matching for per-segment parameters, fixed (`CVE-2026-73511`)
  - This release fixes path matching for per-segment parameters. Advisory: `CVE-2026-73511`.
- **[security]** Cross-user response poisoning on generic HTTP upgrades, fixed (`CVE-2026-73548`)
  - This release fixes cross-user response poisoning on generic HTTP upgrades. Advisory: `CVE-2026-73548`.

## Check if affected
- **[security]** `oghttp2` heap use-after-free, fixed (`CVE-2026-73513`)
  - Applies if you use HTTP/2.
  - This release fixes a heap use-after-free in `oghttp2` when HTTP/2 trailers arrive without the `END_STREAM` flag. Advisory: `CVE-2026-73513`.
- **[security]** `safe_regex` failure in negative-match RBAC policies, fixed (`CVE-2026-73552`)
  - Applies if you use negative-match RBAC policies.
  - This release fixes `safe_regex` failing open on non-UTF-8 header bytes in negative-match RBAC policies. Advisory: `CVE-2026-73552`.
- **[security]** QUIC HTTP datagram handler use-after-free, fixed (`CVE-2026-73512`)
  - Applies if you use the QUIC HTTP datagram handler.
  - This release fixes a use-after-free in the QUIC HTTP datagram handler. Advisory: `CVE-2026-73512`.
- **[security]** `ext_authz` termination on CONNECT requests, fixed (`CVE-2026-73547`)
  - Applies if you use `ext_authz`.
  - This release fixes abnormal termination in `ext_authz` when CONNECT requests do not include a `:path` header. Advisory: `CVE-2026-73547`.
- **[security]** HTTP/3 termination for scoped IPv6 client addresses, fixed (`CVE-2026-73549`)
  - Applies if you use HTTP/3.
  - This release fixes abnormal termination for scoped IPv6 client addresses with HTTP/3. Advisory: `CVE-2026-73549`.
- **[security]** `ext_authz` raw HTTP client use-after-free, fixed (`CVE-2026-50572`)
  - Applies if you use the `ext_authz` raw HTTP client.
  - This release fixes a use-after-free in the `ext_authz` raw HTTP client. Advisory: `CVE-2026-50572`.
- **[security]** Stored cross-site scripting in the `HTML stats interface`, fixed (`CVE-2026-73546`)
  - Applies if you use the `HTML stats interface`.
  - This release fixes stored cross-site scripting in the `HTML stats interface`. Advisory: `CVE-2026-73546`.
- **[security]** HTTP/3 connection-pool selection null-pointer dereference, fixed (`CVE-2026-48521`)
  - Applies if you use HTTP/3.
  - This release fixes a null-pointer dereference during ALPN-based HTTP/3 connection-pool selection. Advisory: `CVE-2026-48521`.
- **[security]** HTTP/2 memory exhaustion through duplicate `Host` headers, fixed (`CVE-2026-73550`)
  - Applies if you use HTTP/2.
  - This release fixes HTTP/2 memory exhaustion through discarded duplicate `Host` headers. Advisory: `CVE-2026-73550`.
- **[security]** RBAC bypass through `ignore_path_parameters_in_path_matching`, fixed (`CVE-2026-73553`)
  - Applies if you configure `ignore_path_parameters_in_path_matching`.
  - This release fixes an RBAC bypass through `ignore_path_parameters_in_path_matching`. Advisory: `CVE-2026-73553`.
- **[security]** `BackendTLSPolicy` plaintext fallback with an unresolved CA reference (GHSA-qm8v-g4f9-qhjx)
  - Applies if you configure `BackendTLSPolicy`, run sidecar proxies, and do not have a `CA reference`.
  - This release fixes `BackendTLSPolicy` failing open to plaintext on sidecar proxies when its CA reference is unresolved. Advisory: GHSA-qm8v-g4f9-qhjx.
- **[security]** `EnvoyFilter` match expression length limit
  - Applies if you configure `EnvoyFilter` with a match expression.
  - The `EnvoyFilter` match expression is limited to 1024 characters in this release.
- **[security]** Authorization policy enforcement on ingress gateways, fixed
  - Applies if you run ingress gateways.
  - This release fixes an issue causing authorization policies not to be enforced.
- **[security]** `Gateway API` `ResolvedRefs` reference disclosure, fixed
  - Applies if you use the `Gateway API`.
  - This release fixes a `Gateway API` issue where a listener’s `ResolvedRefs` status could reveal whether a referenced `Secret` or `ConfigMap` existed when no grant permitted the reference.
- **[security]** `istiod` `RequestAuthentication` `jwksUri` SSRF gap, fixed
  - Applies if `istiod` runs and you configure `jwksUri`.
  - This release fixes an SSRF gap in `istiod`’s `RequestAuthentication` `jwksUri` fetching.
- **[security]** The `ENABLE_XDS_API_GENERATOR_AUTH` default
  - Applies if you do not configure `ENABLE_XDS_API_GENERATOR_AUTH`.
  - `ENABLE_XDS_API_GENERATOR_AUTH` now defaults to `true`. This release supports `ENABLE_XDS_API_GENERATOR_AUTH=false` for compatibility.
- **[security]** Output escaping for `sidecar.istio.io/*` injection annotations, fixed
  - Applies if you configure any of `proxyImage`, `bootstrapOverride`, `logLevel`, `componentLogLevel`, or `agentLogLevel`.
  - This release fixes output escaping for the `proxyImage`, `bootstrapOverride`, `logLevel`, `componentLogLevel`, and `agentLogLevel` `sidecar.istio.io/*` annotations when they are interpolated into sidecar and gateway injection templates.

## Other recorded changes
- 13 (defect_corrected 11, value_changed 2)

[Full analysis](https://ratatosk.io/en/releases/istio/1.29.7)

[Original release notes](https://github.com/istio/istio/releases/tag/1.29.7)