Skip to content

1.30.2

Page as Markdown
Solo build of Istio version 1.30.2 patch release.
This release note describes what’s different between Solo builds of Istio versions 1.30.1 and 1.30.2.
Security Notice

Envoy CVEs

This release includes the following security fixes (see ISTIO-SECURITY-2026-005):
  • GHSA-p7c7-7c47-pwch: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition.
  • CVE-2026-47204: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route.
  • CVE-2026-47205: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check.
  • CVE-2026-47207: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy.
  • CVE-2026-47220: (CVSS score 7.5): Fixed a crash bug in the %REQUESTED_SERVER_NAME% formatter where the host or original host is not set correctly but the formatter is configured to access the host value.
  • CVE-2026-47221: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault.
  • CVE-2026-47692: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host.
  • CVE-2026-47775: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter’s AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a gcm. algorithm marker, which authenticates the ciphertext and removes the oracle.
  • CVE-2026-47778: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions.
  • CVE-2026-48042: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the envoy.reloadable_features.limit_json_parser_nesting_depth to false.
  • CVE-2026-48044: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the MaxInflateRatio limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single process() call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached.
  • CVE-2026-48090: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (onDestroy() had been called), which could lead to accessing dangling pointers and result in UAF/crash.
  • CVE-2026-48497: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use ENVOY_BUG in case the sanity check fails.
  • CVE-2026-48706: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name.
  • CVE-2026-48743: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard envoy.reloadable_features.quic_validate_headers_only_content_length.
General Changes

Solo Flavor Changes

  • Improved istiod scalability in ambient mode by scoping XDS pushes from workload/service Address changes to only the affected waypoints, instead of pushing to all waypoints and proxies. Can be disabled with AMBIENT_SCOPED_ADDRESS_PUSHES=false.
  • Fixed when ServiceEntries are created for services. Any service with a scope of global or segment will have a peered
ServiceEntry created.
  • Fixed cross-network traffic through a waypoint when a service that uses that waypoint
is configured with a route that redirects to another service that does not use that waypoint.
  • Fixed the extra long shutdown window (60s). It is now much faster (~5s).
  • Fixed an issue where changing the solo.io/sidecar-skip-waypoint annotation didn’t trigger a change to the sidecar configuration.
  • Fixed a bug where a ServiceEntry could contain extra hostnames that were previously specified but no longer in use.
  • Fixed incorrect network set on peered node workload entries for nodeport peering.
  • Fixed the peered ServiceEntries to correctly set the networking.istio.io/traffic-distribution annotation based on its precedence order.
  • Fixed sidecar waypoint interop to reduce control plane memory consumption.
  • Fixed the documentation link in istioctl multicluster check --help to point to
docs.solo.io/istio/ instead of the outdated docs.solo.io/gloo-mesh/ path.
  • Fixed order-dependent behavior when more than one istio-remote Gateway maps to the same
cluster. A second istio-remote Gateway for an already-peered cluster could, depending on the
order in which Gateways were created or deleted, displace or tear down that cluster’s control-plane
peering and never rebuild it. The peering controller now deterministically designates a single
control-plane peer per cluster
FIPS Flavor Changes

No changes in this section.
1.30.31.30.1