1.27.9-patch0

Solo build of Istio version 1.27.9-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.9 and 1.27.9-patch0.

Security Notice

Envoy CVEs

• CVE-2026-47774 / GHSA-22m2-hvr2-xqc8: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service.

General Changes

• Built against upstream Istio version 1.27.9, release note can be found here.

Solo Flavor Changes

• Fixed an issue where the ECS controller did not respect custom system namespace configurations, now properly using the configured namespace instead of defaulting to istio-system.

• Fixed an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected.

• Fixed traffic routing failures for global services that use named targetPort values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports.

• Fixed duplicate target port mappings that caused ServiceEntry validation failures.

FIPS Flavor Changes

No changes in this section.