Skip to content

For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

1.29.7

Page as Markdown
Solo build of Istio version 1.29.7 patch release.
This release note describes what’s different between Solo builds of Istio versions 1.29.6 and 1.29.7.
Security Notice

Envoy CVEs

This release includes the following security fixes (see ISTIO-SECURITY-2026-006):
  • CVE-2026-73513: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the END_STREAM flag to an Envoy instance using oghttp2, corrupting stream state and terminating the process.
  • CVE-2026-73552: (CVSS score 7.5): Fixed an issue where safe_regex matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource.
  • CVE-2026-73512: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced.
  • CVE-2026-73547: (CVSS score 7.5): Fixed an abnormal process termination in the ext_authz filter when processing CONNECT requests without a :path pseudo-header.
  • CVE-2026-73549: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3.
  • CVE-2026-50572: (CVSS score 5.9): Fixed a use-after-free in the ext_authz raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing.
  • CVE-2026-73546: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (/stats?format=html) where dynamically named statistics could introduce attacker-controlled content.
  • CVE-2026-48521: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection.
  • CVE-2026-73551: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently.
  • CVE-2026-73511: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication.
  • CVE-2026-73548: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection.
  • CVE-2026-73550: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits.
  • CVE-2026-73553: (CVSS score 7.5): Fixed an authorization bypass when ignore_path_parameters_in_path_matching was enabled, where a path such as /admin;x could bypass an RBAC policy for /admin while still reaching the protected route.
Istio CVEs

  • GHSA-qm8v-g4f9-qhjx: (CVSS score 6.8): Fixed BackendTLSPolicy failing open on sidecar proxies. When the policy’s caCertificateRefs could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected.
Istio security fixes

  • Fixed a control plane denial of service via the EnvoyFilter proxyVersion match expression (spec.configPatches[].match.proxy.proxyVersion), which accepted a regular expression of unbounded length. A user able to create EnvoyFilter resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters.
General Changes

Solo Flavor Changes

  • Added the istioctl license command, which reports the product, state, and expiration
of the Solo license in use by each istiod instance.
  • Added opt-in support for EnterpriseListenerSet (enterprise.solo.io/v1alpha1), a Solo
equivalent of the experimental Gateway API XListenerSet for platforms that cannot install
the gateway.networking.x-k8s.io CRD group. Enable with istiod environment variable
SOLO_ENABLE_ENTERPRISE_LISTENER_SET=true (default false). A real XListenerSet takes
precedence over an EnterpriseListenerSet wherever the two collide.
Cross-namespace references from an EnterpriseListenerSet are authorized by a ReferenceGrant
naming kind ListenerSet in group gateway.networking.k8s.io, so grants keep working unchanged
when migrating to ListenerSet on later Istio releases; a grant naming EnterpriseListenerSet
is not recognized.
An EnterpriseListenerSet listener that overlaps another listener on the same parent Gateway
— which Istio 1.29 still programs — reports an enterprise.solo.io/UpgradeConflictWarning
condition. Istio 1.30 or later applies listener merge precedence and will not program the
overlapping listener.
  • Fixed generated east-west gateway regeneration when PEERING_AUTOMATIC_LOCAL_GATEWAY is enabled and a generated istio-remote gateway is manually modified or deleted.
  • Fixed ztunnel to report the correct egress policies.
  • Fixed ztunnel chart examples for egressPolicies.
  • Fixed applying the draining weight from the east-west gateway when no cluster annotation existed.
  • Fixed ReferenceGrant to field to handle multiple entries; previously only the last entry was effective, causing incorrect RefNotPermitted for references that matched an earlier entry.
FIPS Flavor Changes

No changes in this section.
1.29.7-patch01.29.6