# Istio 1.31.4

> Networking & Messaging · 2026-11-06

A security-focused maintenance release with fixes across ambient mode, policy enforcement, proxy connection handling, control-plane request parsing, multicluster identity checks, and `ztunnel`. It also includes operational correctness repairs, performance improvements, and support for `AUTO_PASSTHROUGH` listeners on ambient east-west gateways.

## Check if affected
- **[security]** Ambient-mode `PeerAuthentication` enforcement, GHSA-rr2c-p22p-6r9r
  - Applies if you use ambient mode with a mesh-wide `STRICT` policy and a workload mode of `PERMISSIVE` or `DISABLE`.
  - Istio 1.31.4 fixes an operator-precedence error that could skip a port-level `STRICT` `PeerAuthentication` in ambient mode when the workload mode was `PERMISSIVE` or `DISABLE` under a mesh-wide `STRICT` policy. This prevented plaintext traffic from reaching a port that required mTLS.
- **[security]** Case-insensitive `AuthorizationPolicy` host conditions, GHSA-7m6f-j3gp-2r53
  - Applies if you use `AuthorizationPolicy` conditions on `request.headers[:authority]` or `request.headers[host]`.
  - Istio 1.31.4 changes `AuthorizationPolicy` conditions on `request.headers[:authority]` and `request.headers[host]` to case-insensitive matching, consistent with host matching. This prevents differently cased host values from bypassing the policy.
- **[security]** `sidecar proxy` conntrack handling, GHSA-cxwg-46mx-q8hf
  - Applies if a `sidecar proxy` receives a new inbound connection that reuses the 4-tuple of a torn-down connection.
  - Istio 1.31.4 fixes stale conntrack handling that could let a new inbound connection bypass the `sidecar proxy` when it reused the 4-tuple of a torn-down connection.
- **[security]** `istiod` xDS resource-name parsing, GHSA-635j-qv98-9275
  - Applies if a workload with a mesh identity sends an `istio.io/debug` xDS request with a resource name that fails URL parsing.
  - Istio 1.31.4 prevents `istiod` from crashing when a workload with a mesh identity sends an `istio.io/debug` xDS request whose resource name fails URL parsing. The fix prevents the resulting control-plane crash loop.
- **[security]** Ambient-mode `AuthorizationPolicy` validation, GHSA-8jw7-82jp-wr2c
  - Applies if you use ambient mode with an `AuthorizationPolicy` containing an empty `to` or `from` entry.
  - Istio 1.31.4 rejects the empty `to` or `from` entries that previously could make `istiod` crash in ambient mode when accepted by the validating webhook. This prevents a crash loop that stopped configuration distribution across the mesh.
- **[security]** Multicluster `CLUSTER_ID` validation, GHSA-gf6w-6mxv-5fj4
  - Applies if you use multicluster installations.
  - Istio 1.31.4 fixes cluster identity handling in multicluster installations so a proxy cannot claim another cluster's `CLUSTER_ID` and receive that cluster's Kubernetes secrets over SDS.
- **[security]** `ztunnel` `traceparent` parsing, GHSA-77vw-rg85-wx5x
  - Applies if `ztunnel` receives a 55-byte `traceparent` header without four dash-separated fields on an inbound HBONE connection.
  - Istio 1.31.4 fixes a `ztunnel` panic when parsing a 55-byte `traceparent` header without four dash-separated fields. The fix prevents the inbound HBONE connection task from terminating and dropping every multiplexed stream on that connection.

## Other recorded changes
- 17 (defect_corrected 16, added 1)

[Full analysis](https://ratatosk.io/en/releases/istio/1.31.4)

[Original release notes](https://github.com/istio/istio/releases/tag/1.31.4)