Skip to content

For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

1.28.10-patch0

Page as Markdown
Solo build of Istio version 1.28.10-patch0 patch release.
This release note describes what’s different between Solo builds of Istio versions 1.28.10 and 1.28.10-patch0.
Security Notice

Envoy CVEs

The following security fixes were backported (see ISTIO-SECURITY-2026-006):
  • CVE-2026-73513: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process.
  • CVE-2026-73552: (CVSS score 7.5): Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource.
  • CVE-2026-73512: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced.
  • CVE-2026-73547: (CVSS score 7.5): Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header.
  • CVE-2026-73549: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3.
  • CVE-2026-50572: (CVSS score 5.9): Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing.
  • CVE-2026-73546: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content.
  • CVE-2026-48521: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection.
  • CVE-2026-73551: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently.
  • CVE-2026-73511: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication.
  • CVE-2026-73548: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection.
  • CVE-2026-73550: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits.
  • CVE-2026-73553: (CVSS score 7.5): Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route.
Istio CVEs

  • GHSA-qm8v-g4f9-qhjx: (CVSS score 6.8): Fixed BackendTLSPolicy failing open on sidecar proxies. When the policy’s caCertificateRefs could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected.
Istio security fixes

  • Fixed a control plane denial of service via the EnvoyFilter proxyVersion match expression (spec.configPatches[].match.proxy.proxyVersion), which accepted a regular expression of unbounded length. A user able to create EnvoyFilter resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters.
General Changes

Solo Flavor Changes

  • Fixed ztunnel to report the correct egress policies.
  • Fixed ztunnel chart examples for egressPolicies.
FIPS Flavor Changes

No changes in this section.
1.28.10