1.29.4

Solo build of Istio version 1.29.4 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.29.3 and 1.29.4.

Security Notice

Envoy CVEs

• CVE-2026-47774 / GHSA-22m2-hvr2-xqc8: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service.

General Changes

• Built against upstream Istio version 1.29.4, release note can be found here.

Solo Flavor Changes

• Improved istioctl multicluster check to support structured output via a new --output (-o) flag. Passing -o json or -o yaml emits all check results as a structured document grouped by cluster.

• Added a service account consistency check to istioctl multicluster check that reports when a remote gateway’s effective service account differs from the corresponding peer east-west gateway.

• Fixed duplicate target port mappings that caused ServiceEntry validation failures.

• Fixed an issue where ServiceEntry resources were not removed after their associated Service was removed.

FIPS Flavor Changes

No changes in this section.