1.28.8

Solo build of Istio version 1.28.8 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.7 and 1.28.8.

Security Notice

Envoy CVEs

• CVE-2026-47774 / GHSA-22m2-hvr2-xqc8: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service.

General Changes

• Built against upstream Istio version 1.28.8, release note can be found here.

Solo Flavor Changes

• Improved istioctl multicluster check to detect missing local Segment resources that cause auto-generated ServiceEntry resources from a peered cluster to be silently dropped. The check now reports rejected peer Segment resources with an actionable message explaining how to resolve the misconfiguration.

• Improved istioctl multicluster check to support structured output via a new --output (-o) flag. Passing -o json or -o yaml emits all check results as a structured document grouped by cluster.

• Improved istioctl multicluster check to also detect rejected peer Segment states caused by hostname mismatches and overlapping Segment domains.

• Added a service account consistency check to istioctl multicluster check that reports when a remote gateway’s effective service account differs from the corresponding peer east-west gateway.

• Fixed duplicate target port mappings that caused ServiceEntry validation failures.

• Fixed an issue where ServiceEntry resources were not removed after their associated Service was removed.

FIPS Flavor Changes

No changes in this section.