# Istio 1.30.4

> Networking & Messaging · 2026-08-27

A security-focused maintenance release with multiple Envoy and Istio vulnerability fixes. It also contains reliability, correctness, validation, and behavior changes that may affect operators using the associated protocols, extensions, policies, or configuration fields.

## Action needed
- **[security]** `CVE-2026-73551` and URL path normalization
  - `CVE-2026-73551` is fixed: URL normalization now handles dot and dot-dot path segments with parameters correctly. The fix ships in this release.
- **[security]** `CVE-2026-73511` and per-segment path matching
  - `CVE-2026-73511` is fixed: path matching now handles per-segment parameters correctly. The fix ships in this release.

## Check if affected
- **[security]** `CVE-2026-73513` and the `oghttp2` heap use-after-free
  - Applies if you use HTTP/2.
  - `CVE-2026-73513` is fixed: `oghttp2` no longer has a heap use-after-free when HTTP/2 trailers arrive without the `END_STREAM` flag. The fix ships in this release.
- **[security]** `CVE-2026-73552` and negative-match RBAC `safe_regex` handling
  - Applies if you configure `safe_regex`.
  - `CVE-2026-73552` is fixed: `safe_regex` no longer fails open on non-UTF-8 header bytes in negative-match RBAC policies. The fix ships in this release.
- **[security]** `CVE-2026-73512` and the QUIC HTTP datagram handler
  - Applies if you use the QUIC HTTP datagram handler.
  - `CVE-2026-73512` is fixed: the QUIC HTTP datagram handler no longer has a use-after-free. The fix ships in this release.
- **[security]** `CVE-2026-73547` and `ext_authz` CONNECT request handling
  - Applies if you use `ext_authz`.
  - `CVE-2026-73547` is fixed: `ext_authz` no longer terminates abnormally when handling CONNECT requests without a `:path` header. The fix ships in this release.
- **[security]** `CVE-2026-73549` and scoped IPv6 addresses with HTTP/3
  - Applies if you use HTTP/3.
  - `CVE-2026-73549` is fixed: scoped IPv6 client addresses no longer cause abnormal termination with HTTP/3. The fix ships in this release.
- **[security]** `CVE-2026-50572` and the `ext_authz` raw HTTP client
  - Applies if you use `ext_authz`.
  - `CVE-2026-50572` is fixed: the `ext_authz` raw HTTP client no longer has a use-after-free. The fix ships in this release.
- **[security]** `CVE-2026-73546` and the HTML stats interface
  - Applies if you expose the HTML stats interface.
  - `CVE-2026-73546` is fixed: the HTML stats interface no longer contains the stored cross-site scripting vulnerability. The fix ships in this release.
- **[security]** `CVE-2026-48521` and HTTP/3 connection-pool selection
  - Applies if you use HTTP/3.
  - `CVE-2026-48521` is fixed: ALPN-based HTTP/3 connection-pool selection no longer causes a null-pointer dereference. The fix ships in this release.
- **[security]** `CVE-2026-73548` and generic HTTP upgrades
  - Applies if you use generic HTTP upgrades.
  - `CVE-2026-73548` is fixed: generic HTTP upgrades no longer permit cross-user response poisoning. The fix ships in this release.
- **[security]** `CVE-2026-73550` and duplicate HTTP/2 `Host` headers
  - Applies if you use HTTP/2.
  - `CVE-2026-73550` is fixed: HTTP/2 no longer permits memory exhaustion through discarded duplicate `Host` headers. The fix ships in this release.
- **[security]** `CVE-2026-73553` and `ignore_path_parameters_in_path_matching`
  - Applies if you configure `ignore_path_parameters_in_path_matching`.
  - `CVE-2026-73553` is fixed: `ignore_path_parameters_in_path_matching` no longer permits an RBAC bypass. The fix ships in this release.
- **[security]** `GHSA-qm8v-g4f9-qhjx` and `BackendTLSPolicy` CA references
  - Applicability is not stated in the release notes.
  - `GHSA-qm8v-g4f9-qhjx` is fixed: `BackendTLSPolicy` no longer fails open to plaintext on sidecar proxies when its CA reference is unresolved. The fix ships in this release.
- **[security]** The `ENABLE_XDS_API_GENERATOR_AUTH` default
  - Applies if you run the XDS API generator (MCP config serving).
  - The XDS API generator for MCP config serving now requires a verified control-plane identity. `ENABLE_XDS_API_GENERATOR_AUTH` defaults to `true`; setting it to `false` disables the requirement for compatibility. The change ships in this release.
- **[security]** Gateway API cross-namespace reference authorization
  - Applicability is not stated in the release notes.
  - Gateway API authorization now runs before resolving cross-namespace `certificateRef` or `caCertificateRef` references. Unauthorized references return `RefNotPermitted`, so listener `ResolvedRefs` status no longer reveals whether the referenced `Secret` or `ConfigMap` exists. The fix ships in this release.
- **[security]** `RequestAuthentication` `jwksUri` address blocking
  - Applies if you configure `jwksUri`.
  - istiod now blocks link-local and known cloud metadata addresses at the dial level when fetching `RequestAuthentication` `jwksUri` values, and rejects responses that are not valid JWKS. Private and loopback ranges remain reachable and can be blocked with `BLOCKED_CIDRS_IN_JWKS_URIS`. The fix ships in this release.
- **[security]** Escaping for `sidecar.istio.io/*` injection annotations
  - Applies if you configure any of the `sidecar.istio.io/*` annotations `proxyImage`, `bootstrapOverride`, `logLevel`, `componentLogLevel`, or `agentLogLevel`.
  - The `sidecar.istio.io/*` annotations `proxyImage`, `bootstrapOverride`, `logLevel`, `componentLogLevel`, and `agentLogLevel` are now escaped at every sidecar and gateway injection template sink. Crafted annotation values can no longer inject additional fields into generated pod or deployment specifications. The fix ships in this release.

## Other recorded changes
- 15 (defect_corrected 14, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/istio/1.30.4)

[Original release notes](https://github.com/istio/istio/releases/tag/1.30.4)