# Istio 1.31.2

> Networking & Messaging · 2026-10-16

A security-focused maintenance release with vulnerability fixes and correctness repairs. It also adds connection and routing controls and changes several operator-visible defaults and constraints.

## Action needed
- **[security]** `MAX_RA_WORKLOAD_CERT_TTL` workload certificate TTL cap
  - The new `MAX_RA_WORKLOAD_CERT_TTL` environment variable caps the workload certificate TTL at a default of `48h`. This constraint limits the certificate lifetime configured through the RA settings, including `MAX_WORKLOAD_CERT_TTL` and `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API`.
- **[security]** `istiod` debug endpoint `proxyID` matching
  - `istiod` debug endpoints, including `/debug/config_dump`, `/debug/edsz`, and the XDS `istio.io/debug/config_dump` type, no longer match `proxyID` as a substring. The fix ships in `istiod` debug endpoint matching.
- **[breaking]** Client-side request timeout behavior
  - Requests now time out on the client side, so a stuck request is canceled and the component can recover on its own. The behavior is associated with `ISTIO_KUBE_HEADER_TIMEOUT`, `ISTIO_KUBE_REQUEST_TIMEOUT`, and the `kube_client_deadline_fired_total` metric.

## Check if affected
- **[security]** `GHSA-8vc2-jrm4-835w` OAuth2 HTTP filter crash fix
  - Applies if you use the `OAuth2 HTTP filter`.
  - `GHSA-8vc2-jrm4-835w` fixes an unauthenticated remote crash in the `OAuth2 HTTP filter` when a `CONNECT` request lacks a `:path` header. The fix ships in the `OAuth2 HTTP filter`.
- **[security]** `GHSA-47vj-9r25-wv5j` API key authentication filter crash fix
  - Applies if you use the `api_key_auth HTTP filter`.
  - `GHSA-47vj-9r25-wv5j` fixes a crash in the `api_key_auth HTTP filter` when a `CONNECT` request lacks a `:path` header. The fix ships in the `api_key_auth HTTP filter`.
- **[security]** `GHSA-w44g-8m76-8gc5` `AuthorizationPolicy` method-rule enforcement
  - Applicability is not stated in the release notes.
  - `GHSA-w44g-8m76-8gc5` fixes an `AuthorizationPolicy` bypass over `HTTP/2` when the request method case is changed. The correction applies to `AuthorizationPolicy` method rules.
- **[security]** `GHSA-7p2q-4xvg-vxc6` ambient-mode `istiod` crash fix
  - Applicability is not stated in the release notes.
  - `GHSA-7p2q-4xvg-vxc6` fixes an `istiod` crash in ambient mode when a `ServiceEntry` or another service claims the address of an IP-addressed waypoint. The fix ships in `istiod`.
- **[security]** `istioctl` script command-injection fix
  - Applicability is not stated in the release notes.
  - `istioctl` no longer permits crafted values to inject additional shell commands when generated scripts are run. The correction ships in `istioctl` script handling.
- **[security]** `CreateCertificate` Kubernetes CSR RA error handling
  - Applies if you configure `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API`.
  - `CreateCertificate` no longer returns raw Kubernetes API error text to callers on the experimental Kubernetes CSR RA path. The correction applies to the `EXTERNAL_CA=ISTIOD_RA_KUBERNETES_API` configuration.
- **[security]** `WASM_INSECURE_REGISTRIES` plaintext retry restriction
  - Applies if you configure `WASM_INSECURE_REGISTRIES`.
  - Plaintext retries now occur only for registries explicitly allowlisted through `WASM_INSECURE_REGISTRIES`. The restriction ships in WASM image registry retry handling.

## Plan ahead
- **[deprecated]** The `overload.global_downstream_max_connections` runtime flag, deprecated
  - Applies if you configure `overload.global_downstream_max_connections`.
  - The `overload.global_downstream_max_connections` runtime flag is deprecated. The deprecation applies to this runtime configuration flag.

## Other recorded changes
- 17 (defect_corrected 12, added 4, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/istio/1.31.2)

[Original release notes](https://github.com/istio/istio/releases/tag/1.31.2)