https://github.com/solo-io/istio Latest Istio releases by Solo.io en-us https://docs.solo.io/istio/1.31.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.31.0 Tue, 08 Sep 2026 00:00:00 GMT Minor Release
Solo build of Istio version 1.31.0 minor release.

This release note describes what's different between Solo builds of Istio versions 1.30.0 and 1.31.0. ## Upgrade Notes ### Waypoints in another network are now selectable endpoints of a merged waypoint service Every cluster running an instance of the waypoint must be able to serve the destinations attached to it. A cluster whose waypoint is present but which does not host the destination service has no configuration for it, and requests that select that waypoint fail. Either deploy the destination in each cluster that runs the waypoint, or give those clusters distinct waypoint names. ### Policies targeting a Service now apply to Global Service traffic A policy whose `targetRefs` names a `kind: Service` now also applies to traffic reaching that service through its Global Service address. This affects `AuthorizationPolicy`, `RequestAuthentication`, `Telemetry`, `TrafficExtension`, `WasmPlugin`, and `EnvoyFilter`. This can deny cross-cluster traffic that was previously allowed, because `mesh.internal` traffic was not subject to these policies before. Review the `from` and `jwtRules` blocks of policies that target a Service and confirm they cover remote-cluster callers. To keep the previous behavior, set `ENABLE_SERVICE_INHERITANCE=false` on istiod, or set the `solo.io/service-inheritance: "false"` annotation on an individual policy. ### ztunnel L7 access logs and distributed tracing are now disabled by default The upgrade re-renders the ztunnel L7 `ConfigMap` from the chart defaults, so meshes that rely on ztunnel HTTP request logs or spans and never set these values explicitly must now opt in with `--set values.ztunnel.l7Telemetry.accessLog.enabled=true` and `--set values.ztunnel.l7Telemetry.distributedTracing.enabled=true`. No restart is required, because ztunnel reloads its L7 configuration. ## General Changes - Upstream Istio 1.31.0 release notes can be found [here](https://istio.io/latest/news/releases/1.31.x/announcing-1.31/). - Built against upstream [Istio commit `304b98beb30986f45d137f32973a52ab0f331c57`](https://github.com/istio/istio/commits/304b98beb30986f45d137f32973a52ab0f331c57/). [Compare](https://github.com/istio/istio/compare/65622076eb2695c8a464e55458103df132f87bb3..304b98beb30986f45d137f32973a52ab0f331c57). ## Solo Flavor Changes - **Improved** istiod scalability in ambient mode by scoping XDS pushes from workload and service `Address` changes to only the affected waypoints, instead of pushing to all waypoints and proxies. Can be disabled with `AMBIENT_SCOPED_ADDRESS_PUSHES=false`. - **Improved** `istioctl multicluster link` to support a `--reconcile` option. When enabled, any `istio-remote` gateway in a `from` context that is not in the `to` context is deleted. - **Updated** `ENABLE_SERVICE_INHERITANCE` to be enabled by default, so policies that target a Service now also apply to traffic addressed to that service's Global Service (`..mesh.internal`). - **Added** the `istioctl license` command, which reports the product, state, and expiration of the Solo license in use by each istiod instance. - **Added** the ability to customize the east-west gateway name to the peering Helm chart. If creating the east-west gateway with the Helm chart, the `eastwest.name` field can be used to control the gateway name. In this case, or if using the chart to create `istio-remote` gateways for an existing east-west gateway with a non-default service account, the `serviceAccountOverride` field on the remote should be set to the corresponding east-west gateway's service account. The service account is either the value of the `gateway.istio.io/service-account` annotation on the east-west gateway, or that gateway's name if the annotation is unset. - **Added** the `AWS_POLLING_INTERVAL` environment variable, which controls the polling interval for ECS and EC2 workload discovery. The default value is one minute. - **Added** a duplicate cluster ID check to `istioctl multicluster check`, reporting clusters and remote gateways that share a `CLUSTER_ID`. - **Added** support for weighted waypoint canaries on global services in a multi-cluster mesh. A canary waypoint and its weight now apply to clients in every cluster, not only the cluster where the canary is configured, so set the canary labels on each cluster's copy of the Service. If the canary is unreachable, the primary waypoint keeps all of the traffic. - **Added** an optional `ecs.solo.io/domain` tag on ECS clusters. When set, it overrides the account-level domain for that cluster and all of its services and tasks. - **Added** an `istioctl ecs add-service --transparent` flag to onboard an EC2-backed Amazon ECS service to the mesh with transparent traffic interception. - **Added** support for `EnterpriseListenerSet` (`enterprise.solo.io/v1alpha1`), a Solo equivalent of the Gateway API `ListenerSet` for platforms that pin Gateway API below 1.5. A Gateway API `ListenerSet` takes precedence over an `EnterpriseListenerSet` wherever the two collide. Cross-namespace references from an `EnterpriseListenerSet` are authorized by a `ReferenceGrant` naming kind `ListenerSet` in group `gateway.networking.k8s.io`, so grants keep working unchanged when migrating to `ListenerSet`; a grant naming `EnterpriseListenerSet` is not recognized. - **Added** docs for the `ISTIO_GPRC_*` environment variables, documenting that they contain a known typo (`GPRC` instead of `GRPC`) and must be set using the misspelled name to take effect. - **Added** support for binding a `NAMESPACE`-visibility `ServiceEntry` (`meshConfig.serviceEntryVisibility`) to a `solo-ztunnel-egress` gateway in another namespace, when the gateway's `allowedRoutes` admit the `ServiceEntry` namespace. The `ServiceEntry` remains invisible outside its own namespace; other waypoint classes still refuse cross-namespace binding. - **Fixed** which services get a peered `ServiceEntry`. Any service with a scope of global or segment now has a peered `ServiceEntry` created for it. - **Fixed** cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint. - **Fixed** waypoint selection so that a waypoint in a peered cluster on another network is now a selectable endpoint of the merged waypoint service. In a mesh that peers flat-network and cross-network clusters, a service whose flat-network waypoints had no endpoints was unreachable with `unknown waypoint`, even though a healthy waypoint served it in the cross-network cluster. - **Fixed** traffic routing for global services that use a waypoint and have both in-network and cross-network backing services. Traffic now always goes through the waypoint instead of bypassing it inconsistently. - **Fixed** the extra-long shutdown window of 60 seconds. Shutdown now takes about 5 seconds. - **Fixed** duplicate target port mappings, which caused `ServiceEntry` validation failures. - **Fixed** `ServiceEntry` resources not being removed after their associated Service was removed. - **Fixed** an issue where modifying the `solo.io/service-inheritance` annotation did not always affect the underlying resource. - **Fixed** an issue where changing the `solo.io/sidecar-skip-waypoint` annotation did not trigger a change to the sidecar configuration. - **Fixed** an issue where a sidecar workload would not send traffic to a destination through its waypoint when the waypoint was added after the workload had already started, causing those requests to fail until the workload was restarted. - **Fixed** a bug where a `ServiceEntry` could contain extra hostnames that were previously specified but are no longer in use. - **Fixed** the incorrect network set on peered node workload entries for NodePort peering. - **Fixed** peered `ServiceEntry` resources to set the `networking.istio.io/traffic-distribution` annotation correctly, based on its precedence order. - **Fixed** sidecar and waypoint interoperability to reduce control plane memory consumption. - **Fixed** generated east-west gateway regeneration when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled and a generated `istio-remote` gateway is manually modified or deleted. - **Fixed** `istioctl multicluster check` reporting a remote gateway as connected when it is not peered because another remote gateway already uses its `CLUSTER_ID`. - **Fixed** ztunnel to report the correct egress policies. - **Fixed** the ztunnel chart examples for `egressPolicies`. - **Fixed** ztunnel when running as an ECS task on EC2, so that it uses the EC2 instance ID as its node name. - **Fixed** ECS discovery to wait until an ECS task is running before including it in the mesh. - **Fixed** `istioctl ecs add-service` to handle empty Docker labels when specifying `ecs-ec2`. - **Fixed** `istioctl ecs add-service` to associate the `ServiceAccount` with the task execution role when specifying `ecs-ec2`. - **Fixed** an issue where, after a pod restart, its sidecar was missing the inbound routes for the `ServiceEntry` hostnames that select it. In multicluster peering, calls to that pod's global `..mesh.internal` hostname from another cluster failed with `503 UC`, and the only recovery was to restart istiod. - **Fixed** the documentation link in `istioctl multicluster check --help` to point to `docs.solo.io/istio/` instead of the outdated `docs.solo.io/gloo-mesh/` path. - **Fixed** order-dependent behavior when more than one `istio-remote` Gateway maps to the same cluster. A second `istio-remote` Gateway for an already-peered cluster could, depending on the order in which Gateways were created or deleted, displace or tear down that cluster's control plane peering and never rebuild it. The peering controller now deterministically designates a single control plane peer per cluster. - **Fixed** ztunnel L7 access logs and distributed tracing, which are now disabled by default. Tracing previously exported to a fixed `http://opentelemetry-collector.istio-system:4317` endpoint that is not part of the install, and the resulting export failures were only logged at `debug` level. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.31.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.31.1 Wed, 23 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.31.1 patch release.

This release note describes what's different between Solo builds of Istio versions 1.31.0 and 1.31.1. ## Upgrade Notes ### Kubernetes API requests are now bounded by client-side deadlines The defaults suit most clusters. Environments with a slow or heavily loaded API server can raise them, or set any of them to `0` to restore the previous unbounded behavior, with these environment variables on the affected component. | Variable | Default | Applies to | | --- | --- | --- | | `ISTIO_KUBE_HEADER_TIMEOUT` | `90s` | How long any request may wait for its first response headers. Must stay above the API server's `--request-timeout` (60s by default). | | `ISTIO_KUBE_REQUEST_TIMEOUT` | `120s` | Total duration of a normal request, including reading the response. Must exceed `ISTIO_KUBE_HEADER_TIMEOUT`. | | `ISTIO_KUBE_STREAM_TIMEOUT` | `15m` | Total duration of a watch or other stream. Must exceed the API server maximum watch duration. | | `ISTIO_INFORMER_REQUEST_TIMEOUT` | `15m` | Total duration of an informer list. Must accommodate a full list of the largest resource in the cluster. | A canceled request increments `kube_client_deadline_fired_total` and logs a warning naming the method and path. ## General Changes - Upstream Istio 1.31.1 release notes can be found [here](https://istio.io/latest/news/releases/1.31.x/announcing-1.31.1/). - Built against upstream [Istio commit `5bb99f9b42f7f34f92d6f48d4360d0a1257a8b46`](https://github.com/istio/istio/commits/5bb99f9b42f7f34f92d6f48d4360d0a1257a8b46/). [Compare](https://github.com/istio/istio/compare/304b98beb30986f45d137f32973a52ab0f331c57..5bb99f9b42f7f34f92d6f48d4360d0a1257a8b46). - **Fixed** [GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx) (CVSS 6.8, Moderate): a fail-open in `BackendTLSPolicy` where sidecar proxies sent upstream traffic in plaintext instead of failing closed when a policy's `caCertificateRefs` could not be resolved. ## Solo Flavor Changes - **Fixed** listeners going dark during an `EnterpriseListenerSet` to `ListenerSet` migration: while the control plane converged on a newly created same-named `ListenerSet`, the superseded `EnterpriseListenerSet` could still be arbitrated against it, marking every listener on both objects conflicted for the convergence window. A superseded `EnterpriseListenerSet` is now excluded from listener conflict arbitration entirely. - **Fixed** Istio components hanging indefinitely when a Kubernetes API request gets no response, for example when a load balancer or proxy silently drops the return path. Previously such a request could stay open forever, stalling the controller that issued it until the process restarted. Requests are now bounded by client-side deadlines, so a stuck request is canceled and the component recovers on its own. Each cancellation is logged as a warning and counted by the `kube_client_deadline_fired_total` metric. - **Fixed** the documentation link in `istioctl multicluster check --help`, which pointed at a path that no longer exists. The link now resolves to the multicluster installation guide at `docs.solo.io/istio/latest/multicluster/install/default/manual/`. - **Fixed** an issue where the network gateway selected for a workload was picked in a random order when a network had more than one gateway entry, which caused unnecessary workload (WDS) pushes on every recompute and could alternate the gateway address a workload uses. - **Fixed** the peering controller re-validating every peer cluster, and with it every peered workload and service, after each of its own `Segment` status writes, which kept the peering leader busy for a long time after a leader change. - **Fixed** an issue where every peered workload was recomputed each time the peering leader updated the `Segment` status, which caused elevated istiod CPU usage and unnecessary xDS pushes during a peering resync. - **Fixed** an issue where Envoy proxies subscribed to Workload metadata discovery (HBONE sidecars and ambient gateways) received a full endpoint (EDS) rebuild on every workload or WorkloadEntry change. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.0 Thu, 28 May 2026 00:00:00 GMT Minor Release
Solo build of Istio version 1.30.0 minor release.

This release note describes what's different between Solo builds of Istio versions 1.29.0 and 1.30.0. ## Upgrade Notes ### Permissions change for ECS discovery Previously, integrating ECS tasks into an ambient mesh only required giving istiod AWS permissions to perform List and Describe actions on ECS clusters, services, and tasks. With this change, istiod must also have permission to perform the `ec2:DescribeNetworkInterfaces` action. ### Helm value `platforms.ecs` renamed to `platforms.aws` The `platforms.ecs` Helm value has been deprecated in favor of `platforms.aws`. The old path is still supported for backwards compatibility but will be removed in a future release. Before: ```yaml platforms: ecs: accounts: - role: arn:aws:iam::1111111111:role/istiod domain: example.acme regions: ["us-east-1"] ``` After: ```yaml platforms: aws: ecsDiscovery: true accounts: - role: arn:aws:iam::1111111111:role/istiod domain: example.acme regions: ["us-east-1"] ``` ## General Changes - Built against upstream Istio version 1.30.0. The release notes can be found [here](https://istio.io/latest/news/releases/1.30.x/announcing-1.30.0). - Built against upstream [Istio commit `65622076eb2695c8a464e55458103df132f87bb3`](https://github.com/istio/istio/commit/65622076eb2695c8a464e55458103df132f87bb3). ## Solo Flavor Changes - **Improved** the `istioctl multicluster check` command with the following enhancements: - Detect missing local `Segment` resources that cause auto-generated `ServiceEntry` resources from a peered cluster to be silently dropped, and report rejected peer segments with an actionable message. - Support structured output via a new `--output` (`-o`) flag. Passing `-o json` or `-o yaml` emits all check results as a structured document grouped by cluster. - Detect rejected peer `Segment` states caused by hostname mismatches and overlapping `Segment` domains. - Validate that all Istio proxy containers and all sidecar-injector `ConfigMap` templates have the `ISTIO_META_NETWORK` environment variable set to match the network label on the `istio-system` namespace. - Verify that `ambient.dnsCapture` is enabled in the `istio-cni-config` `ConfigMap`. - Verify that the `topology.istio.io/cluster` label is present and valid on istio-remote gateways. - Check that a remote gateway's effective service account matches the corresponding peer east-west gateway. - Report hostname conflicts by reading the controller's conflict annotations on auto-generated `ServiceEntry` resources. - Support running against extracted bug-report directories, enabling offline multicluster analysis without direct cluster access. - Dynamically discover east-west gateway names from `Gateway` objects instead of hardcoding `istio-eastwest`. - Correctly detect NodePort east-west gateways that have fallen back to reporting a ClusterIP address by using the peering annotation to detect NodePort mode and validating that the backing `Service` has the required HBONE port. - **Added** service inheritance support via a new `ENABLE_SERVICE_INHERITANCE` environment variable, which allows policies that target a `Service` to also include its `GlobalService` when enabled. Also added a `solo.io/service-inheritance` annotation, which can be set to `true` or `false` to override the environment variable on a per-resource basis. Service inheritance is supported by `AuthorizationPolicy`, `EnvoyFilter`, `RequestAuthentication`, `Telemetry`, `TrafficExtension`, and `WasmPlugin`. - **Added** Route (HTTPRoute, GRPCRoute, TCPRoute, TLSRoute) ParentRefs support GlobalService kind. - **Added** metrics to track mesh config parsing and validation status. New `pilot_meshconfig_validation_status` and `pilot_meshnetworks_validation_status` gauges indicate whether the current mesh configuration is valid (`0`) or invalid (`1`). - **Added** an EC2 instance discovery platform. Auto-discovers EC2 instances tagged with `ec2.solo.io/*` metadata and creates `WorkloadEntry` and `Service` resources. Supports multi-account and multi-region discovery, public/private IP selection, and multi-workload instances. - **Added** `istioctl ec2 add-workload` and `istioctl vm add-workload` commands for registering EC2 instances and generic VMs into the mesh. - **Added** support for using public IPs attached to ECS tasks as `WorkloadEntry` addresses by setting the `ecs.solo.io/use-public-ip` tag on the task to `true`. - **Added** a new environment variable `PEERING_EXCLUDED_METADATA` that defines a comma-delimited string of labels and annotations which are excluded from auto-generated peering resources' metadata. - **Added** the ability to propagate labels from source Kubernetes resources to their peered `WorkloadEntry` counterparts. - The pilot-specific `ENABLE_PEERING_LABEL_PROPAGATION` environment variable value accepts: - A comma-delimited string of label keys that should be propagated if they exist. - The `all` keyword to propagate all labels. - `GlobalService` resources' labels can be propagated. - In a flat-networking scenario, `Pod` resources' labels can be propagated. - **Added** a `--revision` (`-r`) flag to `istioctl bootstrap`, allowing users to target a specific control plane revision. When set, the command looks up `istiod-{revision}` instead of the default `istiod` service. - **Added** support for loading license keys from mounted volumes. The path where the volume is mounted should be provided as the `license.volume` Helm value. - **Added** the `PILOT_PEERING_WE_EXCLUSION_LABELS` environment variable to prevent peering-generated `ServiceEntry` resources from selecting `WorkloadEntry` resources that carry specified label keys. Accepts a comma-separated list of label keys. Any `WorkloadEntry` carrying at least one of these keys will not be selected by a peering-generated `ServiceEntry`. Non-peering `ServiceEntry` resources are unaffected. Defaults to `gloo.solo.io/parent_name`, which excludes GME `VirtualDestination`-generated `WorkloadEntry` resources from peering `ServiceEntry` selection. - **Added** a `gloo.solo.io/NodePortConfigured` status condition on `istio-eastwest` gateways configured for NodePort peering. When the gateway's managed `Service` has no port with `hbone` in its name, the condition is set to `False` with reason `MissingHbonePort` and a descriptive message. When a valid `hbone` port is present, the condition is `True` with reason `Programmed`. - **Added** support for authoring `AuthorizationPolicy` rules that match on per-workload claims carried by the source workload's identity. Enable by setting `ENABLE_WORKLOAD_CLAIMS=true` on ztunnel, or via the ztunnel Helm chart with `--set workloadClaims.enabled=true`. - **Added** `hostnames` to the `Segment` custom resource, allowing customization of additional hostnames for every peered service. - **Added** the `eastwest.peerCaCrl.enabled` Helm value to the peering Helm chart to mirror the ztunnel chart for auto-configuring the necessary CRL environment variable and volume/volumeMount sections for CRL enforcement by the east-west gateway. - **Added** a JWKS debug endpoint to istiod that publishes the CA's signing certificate in JSON Web Key Set format, along with a new `istioctl experimental jwks` command to retrieve it. - **Added** a `CONN ID` column to `istioctl ztunnel-config connections` output, which displays the connection ID for each inbound and outbound ztunnel connection to aid in debugging. - **Added** the `solo.io/sidecar-skip-waypoint` `ServiceEntry` annotation. When set to `"true"`, sidecars ignore the `ServiceEntry`'s `istio.io/use-waypoint` binding and dial the `ServiceEntry` endpoints directly. Ambient proxies and waypoint config generation continue to honor the binding. - **Added** the `solo-ztunnel-egress` `GatewayClass`, which lets the ztunnel `DaemonSet` serve as the egress data plane for ambient workloads. This is an enterprise feature. - **Deprecated** the Helm value `platforms.ecs` in favor of `platforms.aws`. The previous `platforms.ecs.accounts` path is still supported, but users should migrate to the new configuration as it will be removed in a future release. - **Fixed** the peering controller creating `ServiceEntry` resources for services outside the mesh. `Service` resources with global scope labels in namespaces not enrolled in the mesh (no ambient or sidecar injection) are now correctly excluded from peering. - **Fixed** `prefer-other` `ServiceEntry` resolution issues: - Traffic could be non-deterministically routed through a `prefer-other` `ServiceEntry` instead of a non-prefer-other `ServiceEntry` with the same hostname. This could occur when a `VirtualService` referenced a hostname served by both types of `ServiceEntry`, and there was an explicit `Sidecar` scope that limited the visibility of the non-prefer-other `ServiceEntry`. - DNS responses for a hostname served by both a `prefer-other` `ServiceEntry` and a non-prefer-other `ServiceEntry` could include addresses from both, causing DNS flip-flopping. - **Fixed** multiple issues where adding annotations to gateways caused unnecessary restarts: - Adding the draining annotation to the east-west `Gateway`. - Adding the traffic distribution annotation to a `Gateway` (waypoint). - Adding a service-type annotation to the east-west `Gateway`. - **Fixed** `Service` resources that have takeover enabled (either via `solo.io/service-takeover=true` or `solo.io/service-scope=global-only`) to now have their traffic distribution default to `PreferNetwork` unless another traffic distribution is set. This makes the takeover `Service` traffic distribution consistent with the federated `Service` traffic distribution, which defaults to `PreferNetwork` or inherits the base `Service` distribution setting. - **Fixed** an issue in flat-network peering where services with a named `targetPort` caused remote endpoints to be silently dropped. - **Fixed** several ECS discovery issues: - Services with long cluster or service names could not join the mesh due to the `ecs.solo.io/hostname` label value exceeding the 63-character Kubernetes limit. - Workloads failed to register as `WorkloadEntry` resources when no domain was specified for an AWS account. A default domain is now used so workloads are always reachable within the mesh. - The ECS controller did not respect custom system namespace configurations. Now, it properly uses the configured namespace instead of defaulting to `istio-system`. - AWS resource tags passed through as Kubernetes labels are now filtered. Only tags with `*.istio.io/`, `*.solo.io/`, or `*.kubernetes.io/` domain prefixes are passed through to generated Kubernetes objects. - **Fixed** an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected. - **Fixed** traffic routing failures for global services that use named `targetPort` values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports. - **Fixed** sidecar generation with service takeover enabled and no local `Service`. - **Fixed** an issue where outbound clusters could be served with stale metadata-exchange configuration when the set of service endpoints supporting HBONE changed. - **Fixed** an issue where updating a remote cluster's `Segment` custom resource `domain` or `aliases` fields would not regenerate peered `ServiceEntry` hostnames. - **Fixed** an issue where cross-cluster traffic from a sidecar to a non-HBONE sidecar in a flat-network peering topology was sent as plaintext instead of Istio mTLS. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.1 Fri, 05 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.1 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.0 and 1.30.1. ## Security Notice ### Envoy CVEs - __[CVE-2026-47774](https://nvd.nist.gov/vuln/detail/CVE-2026-47774)__ / __[GHSA-22m2-hvr2-xqc8](https://github.com/istio/istio/security/advisories/GHSA-22m2-hvr2-xqc8)__: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service. ## General Changes - Built against upstream Istio version 1.30.1, release note can be found [here](https://istio.io/latest/news/releases/1.30.x/announcing-1.30.1). ## Solo Flavor Changes - **Added** the ability to customize the east-west gateway name to the peering Helm chart. If creating the east-west gateway with the Helm chart, the `eastwest.name` field can be used to control the gateway name. In this case, or if using the chart to create istio-remote gateways for an existing east-west gateway with a non-default service account, the `serviceAccountOverride` field on the remote should be set to the corresponding east-west gateway's service account. The service account is either the value of the `gateway.istio.io/service-account` annotation on the east-west gateway, or that gateway's name if the annotation is unset. - **Fixed** duplicate target port mappings that caused `ServiceEntry` validation failures. - **Fixed** an issue where `ServiceEntry` resources were not removed after their associated `Service` was removed. - **Fixed** an issue where modifying the `solo.io/service-inheritance` annotation did not always affect the underlying resource. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.2 Wed, 24 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.2 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.1 and 1.30.2. ## Security Notice ### Envoy CVEs This release includes the following security fixes (see [ISTIO-SECURITY-2026-005](https://istio.io/latest/news/security/istio-security-2026-005/)): - __[GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch)__: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition. - __[CVE-2026-47204](https://nvd.nist.gov/vuln/detail/CVE-2026-47204)__: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route. - __[CVE-2026-47205](https://nvd.nist.gov/vuln/detail/CVE-2026-47205)__: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check. - __[CVE-2026-47207](https://nvd.nist.gov/vuln/detail/CVE-2026-47207)__: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy. - __[CVE-2026-47220](https://nvd.nist.gov/vuln/detail/CVE-2026-47220)__: (CVSS score 7.5): Fixed a crash bug in the `%REQUESTED_SERVER_NAME%` formatter where the host or original host is not set correctly but the formatter is configured to access the host value. - __[CVE-2026-47221](https://nvd.nist.gov/vuln/detail/CVE-2026-47221)__: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault. - __[CVE-2026-47692](https://nvd.nist.gov/vuln/detail/CVE-2026-47692)__: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host. - __[CVE-2026-47775](https://nvd.nist.gov/vuln/detail/CVE-2026-47775)__: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter's AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a `gcm.` algorithm marker, which authenticates the ciphertext and removes the oracle. - __[CVE-2026-47778](https://nvd.nist.gov/vuln/detail/CVE-2026-47778)__: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions. - __[CVE-2026-48042](https://nvd.nist.gov/vuln/detail/CVE-2026-48042)__: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the `envoy.reloadable_features.limit_json_parser_nesting_depth` to `false`. - __[CVE-2026-48044](https://nvd.nist.gov/vuln/detail/CVE-2026-48044)__: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the `MaxInflateRatio` limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single `process()` call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached. - __[CVE-2026-48090](https://nvd.nist.gov/vuln/detail/CVE-2026-48090)__: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (`onDestroy()` had been called), which could lead to accessing dangling pointers and result in UAF/crash. - __[CVE-2026-48497](https://nvd.nist.gov/vuln/detail/CVE-2026-48497)__: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use `ENVOY_BUG` in case the sanity check fails. - __[CVE-2026-48706](https://nvd.nist.gov/vuln/detail/CVE-2026-48706)__: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name. - __[CVE-2026-48743](https://nvd.nist.gov/vuln/detail/CVE-2026-48743)__: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard `envoy.reloadable_features.quic_validate_headers_only_content_length`. ## General Changes - Built against upstream [Istio commit `f888ab4c8a0c3d0427bb0053fbebbe6b1f7e9a91`](https://github.com/istio/istio/commits/f888ab4c8a0c3d0427bb0053fbebbe6b1f7e9a91/). [Compare](https://github.com/istio/istio/compare/528c509f0b7b820e9acbbac62c32bbdab2f412fd..f888ab4c8a0c3d0427bb0053fbebbe6b1f7e9a91). ## Solo Flavor Changes - **Improved** istiod scalability in ambient mode by scoping XDS pushes from workload/service `Address` changes to only the affected waypoints, instead of pushing to all waypoints and proxies. Can be disabled with `AMBIENT_SCOPED_ADDRESS_PUSHES=false`. - **Fixed** when ServiceEntries are created for services. Any service with a scope of global or segment will have a peered ServiceEntry created. - **Fixed** cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint. - **Fixed** the extra long shutdown window (60s). It is now much faster (~5s). - **Fixed** an issue where changing the `solo.io/sidecar-skip-waypoint` annotation didn't trigger a change to the sidecar configuration. - **Fixed** a bug where a ServiceEntry could contain extra hostnames that were previously specified but no longer in use. - **Fixed** incorrect network set on peered node workload entries for nodeport peering. - **Fixed** the peered ServiceEntries to correctly set the networking.istio.io/traffic-distribution annotation based on its precedence order. - **Fixed** sidecar waypoint interop to reduce control plane memory consumption. - **Fixed** the documentation link in `istioctl multicluster check --help` to point to `docs.solo.io/istio/` instead of the outdated `docs.solo.io/gloo-mesh/` path. - **Fixed** order-dependent behavior when more than one `istio-remote` Gateway maps to the same cluster. A second `istio-remote` Gateway for an already-peered cluster could, depending on the order in which Gateways were created or deleted, displace or tear down that cluster's control-plane peering and never rebuild it. The peering controller now deterministically designates a single control-plane peer per cluster ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.3-patch0 Fri, 07 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.3-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.30.3 and 1.30.3-patch0. ## General Changes - Built against upstream [Istio commit `da9c990125a8a69e59c44474a28470c9762c9e26`](https://github.com/istio/istio/commits/da9c990125a8a69e59c44474a28470c9762c9e26/). [Compare](https://github.com/istio/istio/compare/fed0b778d06baae0df2d3ff07c8e6f2272f975ef..da9c990125a8a69e59c44474a28470c9762c9e26). ## Solo Flavor Changes - **Improved** `istioctl multicluster link` to support a `--reconcile` option. When enabled, any "istio-remote" gateway in a "from" context that is not in the "to" context is deleted. - **Added** the ability to specify the polling interval of ECS workloads discovery using the environment variable, `AWS_POLLING_INTERVAL`. - **Added** a new environment variable, `AWS_POLLING_INTERVAL`, which will control the discovery of EC2 workloads. The default value is 1 minute. - **Added** opt-in support for `EnterpriseListenerSet` (`enterprise.solo.io/v1alpha1`), a Solo equivalent of the Gateway API `ListenerSet` for platforms that pin Gateway API below 1.5. Enable with istiod environment variable `SOLO_ENABLE_ENTERPRISE_LISTENER_SET=true` (default `false` — no behavior change). A Gateway API `ListenerSet` takes precedence over an `EnterpriseListenerSet` wherever the two collide. Cross-namespace references from an `EnterpriseListenerSet` are authorized by a `ReferenceGrant` naming kind `ListenerSet` in group `gateway.networking.k8s.io`, so grants keep working unchanged when migrating to `ListenerSet`; a grant naming `EnterpriseListenerSet` is not recognized. - **Fixed** generated east-west gateway regeneration when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled and a generated istio-remote gateway is manually modified or deleted. - **Fixed** ztunnel to report the correct egress policies. - **Fixed** ztunnel chart examples for `egressPolicies`. - **Fixed** `istioctl ecs add-service` to handle empty docker labels when specifying `ecs-ec2`. - **Fixed** `istioctl ecs add-service` to associate the ServiceAccount to task execution role when specifying `ecs-ec2`. - **Fixed** an issue where, after a pod restart, its sidecar was missing the inbound routes for the `ServiceEntry` hostnames that select it. In multicluster peering, calls to that pod's global `..mesh.internal` hostname from another cluster failed with `503 UC`, and the only recovery was to restart istiod. - **Fixed** applying the draining weight from the east-west gateway when no cluster annotation existed. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.3 Fri, 17 Jul 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.30.2 and 1.30.3. ## General Changes - Built against upstream [Istio commit `fed0b778d06baae0df2d3ff07c8e6f2272f975ef`](https://github.com/istio/istio/commits/fed0b778d06baae0df2d3ff07c8e6f2272f975ef/). [Compare](https://github.com/istio/istio/compare/f888ab4c8a0c3d0427bb0053fbebbe6b1f7e9a91..fed0b778d06baae0df2d3ff07c8e6f2272f975ef). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.4-patch0 Wed, 09 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.4-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.4 and 1.30.4-patch0. ## General Changes - Built against upstream [Istio commit `0d3c3f185fe2413f39d47ae8e660bcb5148e6a0c`](https://github.com/istio/istio/commits/0d3c3f185fe2413f39d47ae8e660bcb5148e6a0c/). [Compare](https://github.com/istio/istio/compare/1d6d2183282cd419f0b00dcc4325808edb25d232..0d3c3f185fe2413f39d47ae8e660bcb5148e6a0c). - **Fixed** an issue where istiod repeatedly serialized the same workload when pushing workload metadata to Envoy proxies. - **Fixed** `istioctl analyze` building Kubernetes clients directly from `istio-system` multicluster secrets without sanitizing the `kubeconfig`, which could allow a crafted secret to run an `exec` credential plugin (or read local files via other unsafe auth fields) on the machine running `istioctl`. The `kubeconfig` is now sanitized the same way istiod already sanitizes these secrets. **Credit**: This vulnerability was discovered and reported by Adam Korczynski. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.4-patch1 Mon, 14 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.4-patch1 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.4-patch0 and 1.30.4-patch1. ## General Changes - Built against upstream [Istio commit `799d3580c2d183c5183e74531381b27c497617e7`](https://github.com/istio/istio/commits/799d3580c2d183c5183e74531381b27c497617e7/). [Compare](https://github.com/istio/istio/compare/0d3c3f185fe2413f39d47ae8e660bcb5148e6a0c..799d3580c2d183c5183e74531381b27c497617e7). - **Fixed** an issue where Envoy proxies subscribed to Workload metadata discovery (MDS) did not receive incremental workload updates for Address-only changes when `AMBIENT_SCOPED_ADDRESS_PUSHES` was enabled (the default). - **Fixed** ListenerSet status reporting so that a ListenerSet with no valid listeners now reports the `Accepted` and `Programmed` conditions as `False` with reason `ListenersNotValid`. Previously the ListenerSet-level conditions could remain `True` even when none of its listeners were usable. - **Fixed** `observedGeneration` getting stuck on a stale value when a resource is modified again while an earlier status write is still queued. ## Solo Flavor Changes - **Fixed** ztunnel closing pooled HBONE connections with `GOAWAY ENHANCE_YOUR_CALM` under chatty TCP traffic by pinning the `h2` crate to 0.4.15. - **Fixed** an issue where Envoy proxies subscribed to Workload metadata discovery (HBONE sidecars and ambient gateways) received a full endpoint (EDS) rebuild on every workload or WorkloadEntry change ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.4-patch2 Thu, 17 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.4-patch2 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.4-patch1 and 1.30.4-patch2. ## General Changes - Built against upstream [Istio commit `eb7cc5e0bd284b568707ba2c9d3074e5effd6fce`](https://github.com/istio/istio/commits/eb7cc5e0bd284b568707ba2c9d3074e5effd6fce/). [Compare](https://github.com/istio/istio/compare/799d3580c2d183c5183e74531381b27c497617e7..eb7cc5e0bd284b568707ba2c9d3074e5effd6fce). - **Fixed** [GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx): a fail-open in `BackendTLSPolicy` where sidecar proxies sent upstream traffic in plaintext instead of failing closed when a policy's `caCertificateRefs` could not be resolved. - **Fixed** an issue in ambient mode where the CNI node agent auto-detected iptables backend (`legacy` vs `nft`) could flip between agent restarts, causing duplicate redirect rules to be written into already-enrolled pods. - **Fixed** the JWKS resolver forcing all public-key fetches to HTTP/1.1. HTTP/2 is now re-enabled, fixing JWKS fetches that fail over HTTP/1.1 through some HTTP CONNECT proxies. - **Fixed** ServiceEntries with a present but empty workload selector incorrectly matching all workloads in their namespace. - **Fixed** the `sidecar.istio.io/statsFlushInterval` annotation producing an invalid Envoy bootstrap for values of one minute or more, and for sub-second values, which prevented the proxy from starting. - **Fixed** the `sidecar.istio.io/statsEvictionInterval` annotation silently truncating sub-second precision. ## Solo Flavor Changes - **Fixed** an issue where the network gateway selected for a workload was picked in a random order when a network had more than one gateway entry, which caused unnecessary workload (WDS) pushes on every recompute and could alternate the gateway address a workload uses. - **Fixed** an issue where every peered workload was recomputed each time the peering leader updated the `Segment` status, which caused elevated istiod CPU usage and unnecessary xDS pushes during a peering resync. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.4 Mon, 31 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.4 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.3-patch0 and 1.30.4. ## Security Notice ### Envoy CVEs This release includes the following security fixes (see [ISTIO-SECURITY-2026-006](https://istio.io/latest/news/security/istio-security-2026-006/)): - __[CVE-2026-73513](https://nvd.nist.gov/vuln/detail/CVE-2026-73513)__: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the `END_STREAM` flag to an Envoy instance using `oghttp2`, corrupting stream state and terminating the process. - __[CVE-2026-73552](https://nvd.nist.gov/vuln/detail/CVE-2026-73552)__: (CVSS score 7.5): Fixed an issue where `safe_regex` matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. - __[CVE-2026-73512](https://nvd.nist.gov/vuln/detail/CVE-2026-73512)__: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. - __[CVE-2026-73547](https://nvd.nist.gov/vuln/detail/CVE-2026-73547)__: (CVSS score 7.5): Fixed an abnormal process termination in the `ext_authz` filter when processing CONNECT requests without a `:path` pseudo-header. - __[CVE-2026-73549](https://nvd.nist.gov/vuln/detail/CVE-2026-73549)__: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. - __[CVE-2026-50572](https://nvd.nist.gov/vuln/detail/CVE-2026-50572)__: (CVSS score 5.9): Fixed a use-after-free in the `ext_authz` raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. - __[CVE-2026-73546](https://nvd.nist.gov/vuln/detail/CVE-2026-73546)__: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (`/stats?format=html`) where dynamically named statistics could introduce attacker-controlled content. - __[CVE-2026-48521](https://nvd.nist.gov/vuln/detail/CVE-2026-48521)__: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection. - __[CVE-2026-73551](https://nvd.nist.gov/vuln/detail/CVE-2026-73551)__: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. - __[CVE-2026-73511](https://nvd.nist.gov/vuln/detail/CVE-2026-73511)__: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. - __[CVE-2026-73548](https://nvd.nist.gov/vuln/detail/CVE-2026-73548)__: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. - __[CVE-2026-73550](https://nvd.nist.gov/vuln/detail/CVE-2026-73550)__: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. - __[CVE-2026-73553](https://nvd.nist.gov/vuln/detail/CVE-2026-73553)__: (CVSS score 7.5): Fixed an authorization bypass when `ignore_path_parameters_in_path_matching` was enabled, where a path such as `/admin;x` could bypass an RBAC policy for `/admin` while still reaching the protected route. ### Istio CVEs - __[GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx)__: (CVSS score 6.8): Fixed `BackendTLSPolicy` failing open on sidecar proxies. When the policy's `caCertificateRefs` could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected. ### Istio security fixes - **Fixed** a control plane denial of service via the `EnvoyFilter` `proxyVersion` match expression (`spec.configPatches[].match.proxy.proxyVersion`), which accepted a regular expression of unbounded length. A user able to create `EnvoyFilter` resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters. ## General Changes - Built against upstream [Istio commit `1d6d2183282cd419f0b00dcc4325808edb25d232`](https://github.com/istio/istio/commits/1d6d2183282cd419f0b00dcc4325808edb25d232/). [Compare](https://github.com/istio/istio/compare/da9c990125a8a69e59c44474a28470c9762c9e26..1d6d2183282cd419f0b00dcc4325808edb25d232). ## Solo Flavor Changes - **Added** the `istioctl license` command, which reports the product, state, and expiration of the Solo license in use by each istiod instance. - **Fixed** listeners going dark during an `EnterpriseListenerSet` to `ListenerSet` migration: while the control plane converged on a newly created same-named `ListenerSet`, the superseded `EnterpriseListenerSet` could still be arbitrated against it, marking every listener on both objects conflicted for the convergence window. A superseded `EnterpriseListenerSet` is now excluded from listener conflict arbitration entirely. - **Fixed** ztunnel when running as an ECS task on EC2, it will use the EC2 instance id as its node name. - **Fixed** ECS discovery to wait until an ECS task is RUNNING before including it into the mesh. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.30.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.30.5 Wed, 23 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.30.5 patch release.

This release note describes what's different between Solo builds of Istio versions 1.30.4-patch2 and 1.30.5. ## Upgrade Notes ### Kubernetes API requests are now bounded by client-side deadlines The defaults suit most clusters. Environments with a slow or heavily loaded API server can raise them, or set any of them to `0` to restore the previous unbounded behavior, with these environment variables on the affected component. | Variable | Default | Applies to | | --- | --- | --- | | `ISTIO_KUBE_HEADER_TIMEOUT` | `90s` | How long any request may wait for its first response headers. Must stay above the API server's `--request-timeout` (60s by default). | | `ISTIO_KUBE_REQUEST_TIMEOUT` | `120s` | Total duration of a normal request, including reading the response. Must exceed `ISTIO_KUBE_HEADER_TIMEOUT`. | | `ISTIO_KUBE_STREAM_TIMEOUT` | `15m` | Total duration of a watch or other stream. Must exceed the API server maximum watch duration. | | `ISTIO_INFORMER_REQUEST_TIMEOUT` | `15m` | Total duration of an informer list. Must accommodate a full list of the largest resource in the cluster. | A canceled request increments `kube_client_deadline_fired_total` and logs a warning naming the method and path. ## General Changes - Upstream Istio 1.30.5 release notes can be found [here](https://istio.io/latest/news/releases/1.30.x/announcing-1.30.5). - Built against upstream [Istio commit `0295c233f5a1d1eed39860af1f2116b73c79ffc7`](https://github.com/istio/istio/commits/0295c233f5a1d1eed39860af1f2116b73c79ffc7/). [Compare](https://github.com/istio/istio/compare/eb7cc5e0bd284b568707ba2c9d3074e5effd6fce..0295c233f5a1d1eed39860af1f2116b73c79ffc7). - **Fixed** an `HTTPRoute` rule with several `InferencePool` backendRefs configuring only one endpoint picker. The picker of the last backendRef listed scored every request on the rule, so the other pools' pickers were never invoked, and a pool with no ready endpoints failed the whole rule rather than its own weighted share. Each pool now gets its own picker, attached to its own weighted cluster. - **Fixed** two `HTTPRoute`s sharing a `rules[].name` on the same gateway overwriting each other's endpoint picker. Rule names only have to be unique within one `HTTPRoute`, but the pickers were keyed by name across all of them, so a route could be served by another route's picker. Pickers are now resolved per backendRef, so a shared name no longer moves one route's picker onto another. - **Fixed** a route rule losing its `InferencePool` endpoint picker when it also carried a CORS filter. Both are written into the same per-filter configuration, and the CORS path replaced the map rather than adding to it. - **Fixed** an issue where the network gateway selected for a workload was picked in a random order when a network had more than one gateway entry, which caused unnecessary workload (WDS) pushes on every recompute and could alternate the gateway address a workload uses. ## Solo Flavor Changes - **Added** a duplicate cluster ID check to `istioctl multicluster check`, reporting clusters and remote gateways that share a `CLUSTER_ID`. - **Fixed** `istioctl multicluster check` reporting a remote gateway as connected when it is not peered because another remote gateway already uses its `CLUSTER_ID`. - **Fixed** Istio components hanging indefinitely when a Kubernetes API request gets no response, for example when a load balancer or proxy silently drops the return path. Previously such a request could stay open forever, stalling the controller that issued it until the process restarted. Requests are now bounded by client-side deadlines, so a stuck request is canceled and the component recovers on its own. Each cancellation is logged as a warning and counted by the `kube_client_deadline_fired_total` metric. - **Fixed** the documentation link in `istioctl multicluster check --help` to point at the documentation for this release rather than `latest`, so the guide it opens matches the version of `istioctl` being run. - **Fixed** the release note for the peering metadata exclusion feature, which named two environment variables that were never added. The feature is controlled by a single environment variable, `PEERING_EXCLUDED_METADATA`. - **Fixed** the peering controller re-validating every peer cluster, and with it every peered workload and service, after each of its own `Segment` status writes, which kept the peering leader busy for a long time after a leader change. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25/ Tue, 04 Mar 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.0 patch release.

This release note describes the changes of Solo builds of Istio version 1.25. ## General This version was built against upstream [Istio release 1.25.0](https://istio.io/latest/news/releases/1.25.x/announcing-1.25/). - Added support for EnvoyFilters to be used in waypoints. - Added support for defining egress policies via Helm installation. - Added support for multi-network, ECS, and peering installations. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25.1/ Tue, 25 Mar 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.1 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.0 and 1.25.1. ## General This version was built against upstream [Istio release 1.25.1](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.1/). - Fixed an issue where improper license checks were being made in FIPS installations. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/istio/istio/commit/6ea8d546ca5f63c0ce43fa0eb6dfdae52eaf66da Fri, 25 Apr 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.2-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.2 and 1.25.2-patch0. ## General This version was built against upstream Istio commit [`6ea8d546ca5f63c0ce43fa0eb6dfdae52eaf66da`](https://github.com/istio/istio/commit/6ea8d546ca5f63c0ce43fa0eb6dfdae52eaf66da). - The peering controller is now a leader elected function and is also responsible for writing the correct status for istio-remote gateways. Since the peering controller now writes the status, the istio-remote gateway is no longer tagged as an unmanaged gateway and the gateway controller is no longer responsible for writing the `Programmed: Programmed` and `Accepted: Accepted` status to the istio-remote gateway. - Removes the distribute-to annotation from the auto-generated remote gateway as it does not play well when the agent is deployed in the management cluster. The configuration distribution annotation is now solely managed by the management server and corresponds to a change in Gloo Mesh Enterprise. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25.2/ Tue, 15 Apr 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.2 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.1 and 1.25.2. ## General This version was built against upstream [Istio release 1.25.2](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.2/). No other Solo-specific changes were included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25.3/ Tue, 13 May 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.3 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.2 and 1.25.3. ## Security Notice This build includes resolution of Envoy [CVE-2025-46821](https://nvd.nist.gov/vuln/detail/CVE-2025-46821). ## General This version was built against upstream [Istio release 1.25.3](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.3/). No other Solo-specific changes were included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25.4/ Tue, 26 Aug 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.4 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.3 and 1.25.4. ## General This version was built against upstream [Istio release 1.25.4](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.4/). No other Solo-specific changes were included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch0 Mon, 20 Oct 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.5 and 1.25.5-patch0, a Solo-specific release. ## Security Notice This build includes fixes for the Envoy CVEs: - [CVE-2025-62504](https://nvd.nist.gov/vuln/detail/CVE-2025-62504): (CVSS score 6.5, Medium): Lua modified large enough response body will cause Envoy to crash. - [CVE-2025-62409](https://nvd.nist.gov/vuln/detail/CVE-2025-62409): (CVSS score 6.6, Medium): Large requests and responses can cause TCP connection pool crash. ## General Changes - Bumped base image of the distroless variant to pick up fixes for [CVE-2025-8058](https://nvd.nist.gov/vuln/detail/CVE-2025-8058). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch1 Thu, 04 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch1 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.5-patch0 and 1.25.5-patch1, a Solo-specific release. ## Security Notice This build includes a fix of Envoy CVEs: - __[CVE-2025-66220](https://nvd.nist.gov/vuln/detail/CVE-2025-66220)__: (CVSS score 8.1, High): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates with `OTHERNAME` SANs containing an embedded null byte as valid. - __[CVE-2025-64527](https://nvd.nist.gov/vuln/detail/CVE-2025-64527)__: (CVSS score 6.5, Medium): Envoy crashes when JWT authentication is configured with the remote JWKS fetching. - __[CVE-2025-64763](https://nvd.nist.gov/vuln/detail/CVE-2025-64763)__: (CVSS score 5.3, Medium): Potential request smuggling from early data after the CONNECT upgrade. ## General This release only features changes related to the Envoy CVE. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch2 Mon, 22 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch2 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.5-patch1 and 1.25.5-patch2, a Solo-specific release. ## Security Notice This build includes a fix of a CVE in the c-ares dependency of Envoy: - __[CVE-2025-62408](https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5)__: (CVSS score 5.9, Medium): Use after free due to connection being cleaned up after error. ## General This release only features changes related to the above CVE. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch3 Fri, 30 Jan 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.25.5-patch2 and 1.25.5-patch3. ## Security Notice When using peered global services in sidecar environments, the generated Envoy cluster configuration was missing the `tlsMode: istio` transport socket match causing local sidecar-to-sidecar traffic to be sent as plaintext. In environments where strict mTLS was used, connectivity would break. ## Solo Flavor Changes - **Fixed** east-west gateway TLS listeners showing an incorrect `UnsupportedProtocol` status when `PILOT_ENABLE_ALPHA_GATEWAY_API` was disabled. - **Fixed** an issue causing envoy clusters for peered global services to not have the tlsMode-istio transport socket configured. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch4 Wed, 18 Feb 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch4 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.25.5-patch3 and 1.25.5-patch4. ## Security Notice - [CVE-2025-61732](https://github.com/advisories/GHSA-8jvr-vh7g-f8gx) (CVSS score 8.6, High): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. - [CVE-2025-68121](https://github.com/advisories/GHSA-h355-32pf-p2xm) (CVSS score 4.8, Moderate): A flaw in `crypto/tls` session resumption allows resumed handshakes to succeed when they should fail if ClientCAs or RootCAs are mutated between the initial and resumed handshake. This can occur when using `Config.Clone` with mutations or `Config.GetConfigForClient`. As a result, clients may resume sessions with unintended servers, and servers may resume sessions with unintended clients. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch5 Wed, 11 Mar 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch5 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.25.5-patch4 and 1.25.5-patch5. ## Security Notice ### Envoy CVEs - __[CVE-2026-26308](https://nvd.nist.gov/vuln/detail/CVE-2026-26308)__: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header. - __[CVE-2026-26311](https://nvd.nist.gov/vuln/detail/CVE-2026-26311)__: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions. - __[CVE-2026-26310](https://nvd.nist.gov/vuln/detail/CVE-2026-26310)__: (CVSS score 5.9, Medium): Fixed a crash in `Utility::getAddressWithPort` when called with a scoped IPv6 address (e.g., `fe80::1%eth0`). - __[CVE-2026-26309](https://nvd.nist.gov/vuln/detail/CVE-2026-26309)__: (CVSS score 5.3, Medium): Fixed an off-by-one write in `JsonEscaper::escapeString()` that could corrupt the string null terminator. ### Istio CVEs The following security fixes were backported: - __[CVE-2026-31838](https://nvd.nist.gov/vuln/detail/CVE-2026-31838)__ / __[GHSA-974c-2wxh-g4ww](https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww)__: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access. - __[CVE-2026-31837](https://nvd.nist.gov/vuln/detail/CVE-2026-31837)__ / __[GHSA-v75c-crr9-733c](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)__: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys. ### Other Istio Security Fixes The following security fixes were backported: - **Fixed** XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration. - **Fixed** potential SSRF in `WasmPlugin` image fetching by validating bearer token realm URLs. - **Fixed** HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch6 Wed, 01 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch6 patch release.

This release note describes what's different between Solo builds of Istio versions 1.25.5-patch5 and 1.25.5-patch6. ## Security Notice - **Envoy Transformation Filter CONNECT Request Crash**: (Severity: High): A vulnerability exists in Solo’s transformation filter. When a route or virtual host is configured with a transformation rule that includes a path-based request matcher, an unauthenticated attacker can send an HTTP CONNECT request, causing Envoy to crash. This is a potential Denial of Service (DoS) attack vector. The crash can be triggered only if you have a transformation with a path matcher defined. This is only possible with an `EnvoyFilter` with a transformation that includes a path matcher: ```yaml patch: operation: MERGE value: typed_per_filter_config: io.solo.transformation: "@type": "type.googleapis.com/transformation.options.gloo.solo.io.TransformationPerRoute" staged_transformations: regular: request_transforms: - matcher: prefix: '/' request_transformation: {} ``` ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.25.5-patch7 Mon, 13 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5-patch7 patch release.

This release note describes what's different between Solo builds of Istio versions 1.25.5-patch6 and 1.25.5-patch7. ## Security Notice This release bumps the Go version to 1.25.9, which includes fixes for the following security vulnerabilities in the Go `crypto` packages: - **[CVE-2026-32280](https://github.com/golang/go/issues/78282)** (CVSS 7.5, High) (`crypto/x509`): During chain building, the amount of work performed is not correctly limited when a large number of intermediate certificates are passed in `VerifyOptions.Intermediates`, which can lead to a denial of service. This affects both direct users of `crypto/x509` and users of `crypto/tls`. - **[CVE-2026-32281](https://github.com/golang/go/issues/78281)** (Unscored, Undergoing Analysis) (`crypto/x509`): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains. - **[CVE-2026-32283](https://github.com/golang/go/issues/78334)** (Unscored, Undergoing Analysis) (`crypto/tls`): If one side of a TLS 1.3 connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. - **[CVE-2026-33810](https://github.com/golang/go/issues/78332)** (Unscored, Undergoing Analysis) (`crypto/x509`): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs that use a different case than the constraint. For example, if a certificate contains the DNS name `*.example.com` and the excluded DNS name `EXAMPLE.COM`, the constraint will not be applied. This only affects validation of otherwise trusted certificate chains. ## General Changes - Built against upstream Istio version 1.25.5-patch7, release note can be found [here](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.5-patch7). - Built against upstream Istio commit `COMMIT`. See the commit and history [here](https://github.com/istio/istio/commits/XXXXXXXXXXXXX/). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.25.x/announcing-1.25.5/ Wed, 03 Sep 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.25.5 patch release.

This release note describes the changes of Solo builds between Istio versions 1.25.4 and 1.25.5. ## Security Notice This build includes a fix of the Envoy CVE: - [CVE-2025-55162](https://github.com/envoyproxy/envoy/security/advisories/GHSA-95j4-hw7f-v2rh) (CVSS score: 6.3, Moderate): "oAuth2 Filter Signout route will not clear cookies because of missing 'Secure;' flag." ## General This version was built against upstream [Istio release 1.25.5](https://istio.io/latest/news/releases/1.25.x/announcing-1.25.5/). - **Added** the telemetry field `pilot_xds_recv_max` to allow monitoring the maximum size of XDS requests received through gRPC. This is a backport from upstream feature that will be introduced in Istio 1.28. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.26.x/announcing-1.26/ Wed, 28 May 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.0 patch release.

This release note describes the changes of Solo builds of Istio version 1.26. ## General This version was built against upstream [Istio release 1.26.0](https://istio.io/latest/news/releases/1.26.x/announcing-1.26/). No other Solo-specific changes included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/istio/istio/commit/06050b371eba3eb23c204a478c20a476f2cfa337 Wed, 11 Jun 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.1-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.1 and 1.26.1-patch0, a Solo-specific build. ## General This version was built against upstream Istio commit [`06050b371eba3eb23c204a478c20a476f2cfa337`](https://github.com/istio/istio/commit/06050b371eba3eb23c204a478c20a476f2cfa337). - Fixed an issue in ztunnel's outlier detection's backoff calculation, which could overflow when too many consecutive failures occurred. ## FIPS Flavor - Fixed an issue where when a license was not set in FIPS builds of proxy, istiod would return an error. Licensing will become enforced in 1.28. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.26.x/announcing-1.26.1/ Fri, 30 May 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.1 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.0 and 1.26.1. ## General This version was built against upstream [Istio release 1.26.1](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.1/). No other Solo-specific changes included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/istio/istio/commit/1ee7aa2f2f950c914c72cbbb96e21f02274dec97 Tue, 22 Jul 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.2-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.2 and 1.26.2-patch0, a Solo-specific build. ## General This version was built against upstream Istio commit [`1ee7aa2f2f950c914c72cbbb96e21f02274dec97`](https://github.com/istio/istio/commit/1ee7aa2f2f950c914c72cbbb96e21f02274dec97). - Fixed an issue where waypoints would duplicate routes when TCP and UDP ports shared the same port number. - Added an override for gateway addresses for multi-network peering. - Fixed an issue in EDS where East/West Gateway endpoints were missing from waypoints when more than two clusters were peered. - Fixed locality weights with multi-network peering. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.26.x/announcing-1.26.2/ Mon, 23 Jun 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.2 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.1-patch0 and 1.26.2. ## General This version was built against upstream [Istio release 1.26.2](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.2/). No other Solo-specific changes were included in this build. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/istio/istio/commit/00a1751421300ce4aaf9ac5366b140b854dcfe36 Tue, 12 Aug 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.3-patch1 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.3 and 1.26.3-patch1, a Solo-specific build. ## General This version was built against upstream Istio commit [`00a1751421300ce4aaf9ac5366b140b854dcfe36`](https://github.com/istio/istio/commit/00a1751421300ce4aaf9ac5366b140b854dcfe36). - Backported a fix for Envoy where the TLS inspector listener filter timed out when used with other listener filters. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.26.x/announcing-1.26.3/ Tue, 22 Jul 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.3 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.2-patch0 and 1.26.3. ## General This version was built against upstream [Istio release 1.26.3](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.3/). - Replaced `istio.io/expose-istiod-address` with a more general `istio.io/expose-gateway-address` annotation which drives the address list in gateway statuses. It will be picked up when generating istio-remote Gateways for multicluster and bootstrap generation for ECS to determine how to reach istiod for XDS. Istiod will program proxies to send cross-network traffic over the address(es) configured by this annotation. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.26.x/announcing-1.26.4/ Wed, 03 Sep 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.4 patch release.

This release note describes the changes of Solo builds between Istio versions 1.26.3 and 1.26.4. ## Security Notice This build includes fixes of the Envoy CVEs: - [CVE-2025-55162](https://github.com/envoyproxy/envoy/security/advisories/GHSA-95j4-hw7f-v2rh) (CVSS score: 6.3, Moderate): "oAuth2 Filter Signout route will not clear cookies because of missing 'Secure;' flag." - [CVE-2025-54588](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw) (CVSS score: 7.5, High): "Use after free in DNS cache" ## General This version was built against upstream [Istio release 1.26.4](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.4/). - **Added** the telemetry field `pilot_xds_recv_max` to allow monitoring the maximum size of XDS requests received through gRPC. This is a backport from upstream feature that will be introduced in Istio 1. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.5 Wed, 15 Oct 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.5 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.4 and 1.26.5. ## General Changes - Built against upstream Istio version 1.26.5, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.5). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.6 Mon, 20 Oct 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.6 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.5 and 1.26.6. ## Security Notice This build includes fixes for the Envoy CVEs: - [CVE-2025-62504](https://nvd.nist.gov/vuln/detail/CVE-2025-62504): (CVSS score 6.5, Medium): Lua modified large enough response body will cause Envoy to crash. - [CVE-2025-62409](https://nvd.nist.gov/vuln/detail/CVE-2025-62409): (CVSS score 6.6, Medium): Large requests and responses can cause TCP connection pool crash. ## General Changes - Built against upstream Istio version 1.26.6, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.6). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.7 Thu, 04 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.7 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.6 and 1.26.7. ## Security Notice This build includes a fix of Envoy CVEs: - __[CVE-2025-66220](https://nvd.nist.gov/vuln/detail/CVE-2025-66220)__: (CVSS score 8.1, High): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates with `OTHERNAME` SANs containing an embedded null byte as valid. - __[CVE-2025-64527](https://nvd.nist.gov/vuln/detail/CVE-2025-64527)__: (CVSS score 6.5, Medium): Envoy crashes when JWT authentication is configured with the remote JWKS fetching. - __[CVE-2025-64763](https://nvd.nist.gov/vuln/detail/CVE-2025-64763)__: (CVSS score 5.3, Medium): Potential request smuggling from early data after the CONNECT upgrade. ## General Changes - Built against upstream Istio version 1.26.7, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.7). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch0 Fri, 30 Jan 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.8 and 1.26.8-patch0. ## Security Notice When using peered global services in sidecar environments, the generated Envoy cluster configuration was missing the `tlsMode: istio` transport socket match causing local sidecar-to-sidecar traffic to be sent as plaintext. In environments where strict mTLS was used, connectivity would break. ## Solo Flavor Changes - **Fixed** east-west gateway TLS listeners showing an incorrect `UnsupportedProtocol` status when `PILOT_ENABLE_ALPHA_GATEWAY_API` was disabled. - **Fixed** an issue causing envoy clusters for peered global services to not have the tlsMode-istio transport socket configured. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch1 Wed, 18 Feb 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch1 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.8-patch0 and 1.26.8-patch1. ## Security Notice - [CVE-2025-61732](https://github.com/advisories/GHSA-8jvr-vh7g-f8gx) (CVSS score 8.6, High): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. - [CVE-2025-68121](https://github.com/advisories/GHSA-h355-32pf-p2xm) (CVSS score 4.8, Moderate): A flaw in `crypto/tls` session resumption allows resumed handshakes to succeed when they should fail if ClientCAs or RootCAs are mutated between the initial and resumed handshake. This can occur when using `Config.Clone` with mutations or `Config.GetConfigForClient`. As a result, clients may resume sessions with unintended servers, and servers may resume sessions with unintended clients. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch2 Wed, 11 Mar 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch2 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.8-patch1 and 1.26.8-patch2. ## Security Notice ### Envoy CVEs - __[CVE-2026-26308](https://nvd.nist.gov/vuln/detail/CVE-2026-26308)__: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header. - __[CVE-2026-26311](https://nvd.nist.gov/vuln/detail/CVE-2026-26311)__: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions. - __[CVE-2026-26310](https://nvd.nist.gov/vuln/detail/CVE-2026-26310)__: (CVSS score 5.9, Medium): Fixed a crash in `Utility::getAddressWithPort` when called with a scoped IPv6 address (e.g., `fe80::1%eth0`). - __[CVE-2026-26309](https://nvd.nist.gov/vuln/detail/CVE-2026-26309)__: (CVSS score 5.3, Medium): Fixed an off-by-one write in `JsonEscaper::escapeString()` that could corrupt the string null terminator. ### Istio CVEs The following security fixes were backported: - __[CVE-2026-31838](https://nvd.nist.gov/vuln/detail/CVE-2026-31838)__ / __[GHSA-974c-2wxh-g4ww](https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww)__: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access. - __[CVE-2026-31837](https://nvd.nist.gov/vuln/detail/CVE-2026-31837)__ / __[GHSA-v75c-crr9-733c](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)__: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys. ### Other Istio Security Fixes The following security fixes were backported: - **Fixed** XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration. - **Fixed** potential SSRF in `WasmPlugin` image fetching by validating bearer token realm URLs. - **Fixed** HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch3 Wed, 01 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch3 patch release.

This release note describes what's different between Solo builds of Istio versions 1.26.8-patch2 and 1.26.8-patch3. ## Security Notice - **Envoy Transformation Filter CONNECT Request Crash**: (Severity: High): A vulnerability exists in Solo’s transformation filter. When a route or virtual host is configured with a transformation rule that includes a path-based request matcher, an unauthenticated attacker can send an HTTP CONNECT request, causing Envoy to crash. This is a potential Denial of Service (DoS) attack vector. The crash can be triggered only if you have a transformation with a path matcher defined. This is only possible with an `EnvoyFilter` with a transformation that includes a path matcher: ```yaml patch: operation: MERGE value: typed_per_filter_config: io.solo.transformation: "@type": "type.googleapis.com/transformation.options.gloo.solo.io.TransformationPerRoute" staged_transformations: regular: request_transforms: - matcher: prefix: '/' request_transformation: {} ``` ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch4 Mon, 13 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch4 patch release.

This release note describes what's different between Solo builds of Istio versions 1.26.8-patch3 and 1.26.8-patch4. ## Security Notice This release bumps the Go version to 1.25.9, which includes fixes for the following security vulnerabilities in the Go `crypto` packages: - **[CVE-2026-32280](https://github.com/golang/go/issues/78282)** (CVSS 7.5, High) (`crypto/x509`): During chain building, the amount of work performed is not correctly limited when a large number of intermediate certificates are passed in `VerifyOptions.Intermediates`, which can lead to a denial of service. This affects both direct users of `crypto/x509` and users of `crypto/tls`. - **[CVE-2026-32281](https://github.com/golang/go/issues/78281)** (Unscored, Undergoing Analysis) (`crypto/x509`): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains. - **[CVE-2026-32283](https://github.com/golang/go/issues/78334)** (Unscored, Undergoing Analysis) (`crypto/tls`): If one side of a TLS 1.3 connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. - **[CVE-2026-33810](https://github.com/golang/go/issues/78332)** (Unscored, Undergoing Analysis) (`crypto/x509`): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs that use a different case than the constraint. For example, if a certificate contains the DNS name `*.example.com` and the excluded DNS name `EXAMPLE.COM`, the constraint will not be applied. This only affects validation of otherwise trusted certificate chains. ## General Changes - Built against upstream Istio version 1.26.8-patch4, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.8-patch4). - Built against upstream Istio commit `COMMIT`. See the commit and history [here](https://github.com/istio/istio/commits/XXXXXXXXXXXXX/). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch5 Fri, 05 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch5 patch release.

This release note describes what's different between Solo builds of Istio versions 1.26.8-patch4 and 1.26.8-patch5. ## Security Notice ### Envoy CVEs The following security fix was backported (see [ISTIO-SECURITY-2026-004](https://istio.io/latest/news/security/istio-security-2026-004/)): - __[CVE-2026-47774](https://nvd.nist.gov/vuln/detail/CVE-2026-47774)__ / __[GHSA-22m2-hvr2-xqc8](https://github.com/istio/istio/security/advisories/GHSA-22m2-hvr2-xqc8)__: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service. ## General Changes - Built against upstream Istio version 1.26.8, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.8). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch6 Wed, 24 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch6 patch release.

This release note describes what's different between Solo builds of Istio versions 1.26.8-patch5 and 1.26.8-patch6. ## Security Notice ### Envoy CVEs The following security fixes were backported (see [ISTIO-SECURITY-2026-005](https://istio.io/latest/news/security/istio-security-2026-005/)): - __[GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch)__: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition. - __[CVE-2026-47204](https://nvd.nist.gov/vuln/detail/CVE-2026-47204)__: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route. - __[CVE-2026-47205](https://nvd.nist.gov/vuln/detail/CVE-2026-47205)__: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check. - __[CVE-2026-47207](https://nvd.nist.gov/vuln/detail/CVE-2026-47207)__: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy. - __[CVE-2026-47221](https://nvd.nist.gov/vuln/detail/CVE-2026-47221)__: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault. - __[CVE-2026-47692](https://nvd.nist.gov/vuln/detail/CVE-2026-47692)__: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host. - __[CVE-2026-47775](https://nvd.nist.gov/vuln/detail/CVE-2026-47775)__: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter's AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a `gcm.` algorithm marker, which authenticates the ciphertext and removes the oracle. - __[CVE-2026-47778](https://nvd.nist.gov/vuln/detail/CVE-2026-47778)__: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions. - __[CVE-2026-48042](https://nvd.nist.gov/vuln/detail/CVE-2026-48042)__: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the `envoy.reloadable_features.limit_json_parser_nesting_depth` to `false`. - __[CVE-2026-48044](https://nvd.nist.gov/vuln/detail/CVE-2026-48044)__: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the `MaxInflateRatio` limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single `process()` call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached. - __[CVE-2026-48090](https://nvd.nist.gov/vuln/detail/CVE-2026-48090)__: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (`onDestroy()` had been called), which could lead to accessing dangling pointers and result in UAF/crash. - __[CVE-2026-48497](https://nvd.nist.gov/vuln/detail/CVE-2026-48497)__: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use `ENVOY_BUG` in case the sanity check fails. - __[CVE-2026-48706](https://nvd.nist.gov/vuln/detail/CVE-2026-48706)__: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name. - __[CVE-2026-48743](https://nvd.nist.gov/vuln/detail/CVE-2026-48743)__: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard `envoy.reloadable_features.quic_validate_headers_only_content_length`. ## General Changes - Built against upstream [Istio commit `b7ba5cbd39341471ce7a0e71c57fe6e750148a5b`](https://github.com/istio/istio/commits/b7ba5cbd39341471ce7a0e71c57fe6e750148a5b/). This is a proxy-only security backport; the upstream Istio commit is unchanged from 1.26.8-patch5. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8-patch7 Mon, 31 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8-patch7 patch release.

This release note describes what's different between Solo builds of Istio versions 1.26.8-patch6 and 1.26.8-patch7. ## Security Notice ### Envoy CVEs The following security fixes were backported (see [ISTIO-SECURITY-2026-006](https://istio.io/latest/news/security/istio-security-2026-006/)): - __[CVE-2026-73513](https://nvd.nist.gov/vuln/detail/CVE-2026-73513)__: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the `END_STREAM` flag to an Envoy instance using `oghttp2`, corrupting stream state and terminating the process. - __[CVE-2026-73552](https://nvd.nist.gov/vuln/detail/CVE-2026-73552)__: (CVSS score 7.5): Fixed an issue where `safe_regex` matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. - __[CVE-2026-73512](https://nvd.nist.gov/vuln/detail/CVE-2026-73512)__: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. - __[CVE-2026-73547](https://nvd.nist.gov/vuln/detail/CVE-2026-73547)__: (CVSS score 7.5): Fixed an abnormal process termination in the `ext_authz` filter when processing CONNECT requests without a `:path` pseudo-header. - __[CVE-2026-73549](https://nvd.nist.gov/vuln/detail/CVE-2026-73549)__: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. - __[CVE-2026-50572](https://nvd.nist.gov/vuln/detail/CVE-2026-50572)__: (CVSS score 5.9): Fixed a use-after-free in the `ext_authz` raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. - __[CVE-2026-73546](https://nvd.nist.gov/vuln/detail/CVE-2026-73546)__: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (`/stats?format=html`) where dynamically named statistics could introduce attacker-controlled content. - __[CVE-2026-48521](https://nvd.nist.gov/vuln/detail/CVE-2026-48521)__: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection. - __[CVE-2026-73551](https://nvd.nist.gov/vuln/detail/CVE-2026-73551)__: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. - __[CVE-2026-73511](https://nvd.nist.gov/vuln/detail/CVE-2026-73511)__: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. - __[CVE-2026-73548](https://nvd.nist.gov/vuln/detail/CVE-2026-73548)__: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. - __[CVE-2026-73550](https://nvd.nist.gov/vuln/detail/CVE-2026-73550)__: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. - __[CVE-2026-73553](https://nvd.nist.gov/vuln/detail/CVE-2026-73553)__: (CVSS score 7.5): Fixed an authorization bypass when `ignore_path_parameters_in_path_matching` was enabled, where a path such as `/admin;x` could bypass an RBAC policy for `/admin` while still reaching the protected route. ### Istio CVEs - __[GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx)__: (CVSS score 6.8): Fixed `BackendTLSPolicy` failing open on sidecar proxies. When the policy's `caCertificateRefs` could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected. ### Istio security fixes - **Fixed** a control plane denial of service via the `EnvoyFilter` `proxyVersion` match expression (`spec.configPatches[].match.proxy.proxyVersion`), which accepted a regular expression of unbounded length. A user able to create `EnvoyFilter` resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters. ## General Changes - Built against upstream [Istio commit `b7ba5cbd39341471ce7a0e71c57fe6e750148a5b`](https://github.com/istio/istio/commits/b7ba5cbd39341471ce7a0e71c57fe6e750148a5b/). The upstream Istio commit is unchanged from 1.26.8-patch6. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.26.8 Mon, 22 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.26.8 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.26.7 and 1.26.8. ## Security Notice This build includes a fix of a CVE in the c-ares dependency of Envoy: - __[CVE-2025-62408](https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5)__: (CVSS score 5.9, Medium): Use after free due to connection being cleaned up after error. ## General Changes - Built against upstream Istio version 1.26.8, release note can be found [here](https://istio.io/latest/news/releases/1.26.x/announcing-1.26.8). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.0-patch0 Mon, 25 Aug 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.0-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.27.0 and 1.27.0-patch0. ## General This version was built against upstream [Istio commit 43a803a4813f49224e199e412f0a5efbe2ea92db](https://github.com/istio/istio/commit/43a803a4813f49224e199e412f0a5efbe2ea92db). [Comparison](https://github.com/istio/istio/compare/1.27.0..43a803a4813f49224e199e412f0a5efbe2ea92db) - **Bumped** Envoy dependency to [9fadb0ac6f6637742f8c85b9ede005d43fcd1b0c](https://github.com/envoyproxy/envoy/commit/9fadb0ac6f6637742f8c85b9ede005d43fcd1b0c) to pickup additional bugfixes. [Comparison](https://github.com/envoyproxy/envoy/compare/84305a6cb64bd55aaf606bdd53de7cd6080427a1..9fadb0ac6f6637742f8c85b9ede005d43fcd1b0c) ## Solo Flavor Changes - **Fixed** an issue where ambient workloads attempted to send HBONE to plaintext workloads on other clusters when using flat-network multicluster configurations. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.27.x/announcing-1.27/ Wed, 13 Aug 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.0 patch release.

This release note describes the changes of Solo builds of Istio version 1.27. ## General This version was built against upstream [Istio release 1.27.0](https://istio.io/latest/news/releases/1.27.x/announcing-1.27/). - **Added** istiod support for per-service account mTLS egress via a single waypoint. - This is enabled by adding the environment variable`PERMIT_CROSS_NAMESPACE_RESOURCE_ACCESS` to istiod, the value is a comma-separated list of `namespace/gateway` pairs. Gateway is the name of the waypoint's service account. - This also includes sample manifests under `samples/solo-mtls-egress` to demonstrate how to use this feature. - This feature requires a valid license capable of enabling our EnvoyFilter waypoint support. - **Added** the command `istioctl multicluster check` which will iterate through a few different checks on the status of multicluster for the current Kubernetes context. The following checks are performed: - Checks the license in use by each istiod and validates that it supports multicluster - Checks the health of all istiod, ztunnel, and eastwest gateway pods - Checks that the eastwest gateway is programmed - Checks that each remote gateway has a gloo.solo.io/PeeringSucceeded status of True - **Added** syncing of peer connection status to remote Gateways - **Added** to the `istioctl multicluster check` command, a flag to pass in multiple contexts and run checks against all of them. - **Improved** the `istioctl multicluster check` command to use the new `gloo.solo.io/PeerConnected` gateway condition which accurately reflects the current connected status of istiod to remote peers. - **Fixed** an issue where if a Service only existed in the remote cluster, the local cluster would not be able to apply L7 policies via a local sidecar or waypoint, as long as the remote Service properly declared an L7 protocol via the port name or `appProtocol`. - **Fixed** the `istioctl multicluster check` command's pod check being inconsistently ordered. - **Fixed** an issue where locality information was not being propagated for peered multi-cluster resources when the `istio-remote` Gateway's `topology.kubernetes.io/zone` and `topology.kubernetes.io/region` labels were updated without restarting istiod. Now, the labels changing will trigger an update without a restart. - **Fixed** an issue with locality weighting in multi-network cases. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.1-patch0 Fri, 05 Sep 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.1-patch0 patch release.

This release note describes the changes of Solo builds between Istio versions 1.27.1 and 1.27.1-patch0. ## General This version was built against upstream [Istio commit b97585886f7c4040c25c8ba0e5b883302c33e57f](https://github.com/istio/istio/commit/b97585886f7c4040c25c8ba0e5b883302c33e57f). [Comparison](https://github.com/istio/istio/compare/1.27.1..b97585886f7c4040c25c8ba0e5b883302c33e57f) ## Solo Flavor Changes - **Fixed** multi-cluster traffic breaking when each cluster uses a different trust domain. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.1-patch1 Mon, 15 Sep 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.1-patch1 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.1 and 1.27.1-patch1. ## General Changes - Built against upstream [Istio commit `834871d5c9985ff9caadd5404a4bd5057487d885`](https://github.com/istio/istio/commits/834871d5c9985ff9caadd5404a4bd5057487d885/). [Compare](https://github.com/istio/istio/compare/1.27.1..834871d5c9985ff9caadd5404a4bd5057487d885). ## Solo Flavor Changes - **Improved** the experience when using `istioctl multicluster check` against installations <1.27 by checking the `gloo.solo.io/PeeringSucceeded` remote gateway condition. - **Fixed** if a Service only exists in the remote cluster, the local cluster will now be able to apply L7 policy via a local sidecar or waypoint, as long as the remote Service properly declares an L7 protocol via the port name or `appProtocol`. - **Fixed** Services with `solo.io/service-scope=global-only` will now be reachable via standard Kubernetes service hostnames whether the local cluster has a copy of the service or not. - **Fixed** istiod crash when supplying a license to a FIPS-compliant version using a license secret. - **Fixed** deleting a remote service did not delete the corresponding service entry in the local cluster. - **Fixed** multi-cluster traffic breaking when each cluster uses a different trust domain. - **Fixed** to-workload traffic through a waypoint failing when peering is enabled (regardless of actual multi-cluster installation or traffic). - **Fixed** traffic routing through the local cluster's waypoint proxy when a service exists only on remote cluster, but the same waypoint is also deployed locally. Traffic now correctly routes to remote waypoint proxies when the service only exists remotely. - **Fixed** rare istiod crash when using multi-cluster ambient with waypoints. - **Fixed** traffic breaking when a waypoint from the local cluster is deleted while one still exists on the remote cluster. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://istio.io/latest/news/releases/1.27.x/announcing-1.27.1/ Thu, 04 Sep 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.1 patch release.

This release note describes the changes of Solo builds between Istio versions 1.27.0-patch0 and 1.27.1. ## Security Notice This build includes fixes of the Envoy CVEs: - [CVE-2025-55162](https://github.com/envoyproxy/envoy/security/advisories/GHSA-95j4-hw7f-v2rh) (CVSS score: 6.3, Moderate): "oAuth2 Filter Signout route will not clear cookies because of missing 'Secure;' flag." - [CVE-2025-54588](https://github.com/envoyproxy/envoy/security/advisories/GHSA-g9vw-6pvx-7gmw) (CVSS score: 7.5, High): "Use after free in DNS cache." ## General This version was built against upstream [Istio release 1.27.1](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.1/). ## Solo Flavor Changes - **Added** the telemetry field `pilot_xds_recv_max` to allow monitoring the maximum size of XDS requests received through gRPC. This is a backport from upstream feature that will be introduced in Istio 1.28. - **Fixed** a race condition that occasionally missed global Services when peering from remote clusters. - **Fixed** an issue where changes to Service resources were not propagated to their associated global services. - **Fixed** an issue where any external modification of auto-generated resources for multi-cluster peering would be restored to its original state. - **Fixed** a race condition where gateway status updates were conflicting with gateway updates. Retries are now attempted when an error occurs. - **Fixed** ambient workloads attempting to send HBONE to plaintext workloads on other clusters when using flat network multicluster. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.2 Wed, 15 Oct 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.2 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.1-patch1 and 1.27.2. ## General Changes - Built against upstream Istio version 1.27.2, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.2). ## Solo Flavor Changes - **Added** support for labeling Namespaces with `solo.io/service-scope` to allow setting the default scope for all services in the namespace. Labeling individual Services will take precedence over the Namespace label. Setting the scope to "cluster" allows opting out an individual service when the namespace is marked as "global" or "global-only". - **Fixed** an issue where traffic did not traverse remote-only waypoints with flat networking. - **Fixed** an issue where in connections to east/west gateways from Envoy proxies (sidecar, waypoint, ingress), the outer HBONE connection used port 15008, rather than the HBONE port specified in the istio-remote gateway. This presented a problem when specifying NodePort east/west gateways. - **Fixed** missing gateway reconciliation statuses for service-type changes. - **Fixed** an issue where locality information was not being propagated for peered multi-cluster resources when the `istio-remote` Gateway's `topology.istio.io/subzone` was specified. - **Fixed** an issue where workloads added with the `--external` flag using `istioctl bootstrap` or `istioctl ecs add-server` wouldn't be able to route traffic due to no `networkGateway` being attached. - **Removed** an incorrect `UnsupportedProtocol` warning from Gateway resources for east-west gateways. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.3-patch0 Wed, 19 Nov 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.3-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.3 and 1.27.3-patch0. ## General Changes - Built against upstream [Istio commit `44bd16d30604528e2b16628f3dd687625a96b773`](https://github.com/istio/istio/commits/44bd16d30604528e2b16628f3dd687625a96b773/). [Compare](https://github.com/istio/istio/compare/1.27.3..44bd16d30604528e2b16628f3dd687625a96b773). ## Solo Flavor Changes - **Added** an environment variable to istiod `DISABLE_LEGACY_MULTICLUSTER` to disable legacy remote secrets based mult-cluster. This is useful for migrating from a legacy sidecar environment by setting this on the new revision of the control plane. - **Fixed** invalid service entry generation when service port is not named. - **Fixed** local eastwest gateways not being translated into `networkGateways` when the cluster name matches the network ID. - **Fixed** incorrect trust domain set on peered flat-networking workloads. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.3 Tue, 21 Oct 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.2 and 1.27.3. ## Security Notice This build includes fixes for the Envoy CVEs: - [CVE-2025-62504](https://nvd.nist.gov/vuln/detail/CVE-2025-62504): (CVSS score 6.5, Medium): Lua modified large enough response body will cause Envoy to crash. - [CVE-2025-62409](https://nvd.nist.gov/vuln/detail/CVE-2025-62409): (CVSS score 6.6, Medium): Large requests and responses can cause TCP connection pool crash. ## General Changes - Built against upstream Istio version 1.27.3, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.3). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.4 Thu, 04 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.4 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.3-patch0 and 1.27.4. ## Security Notice This build includes a fix of Envoy CVEs: - __[CVE-2025-66220](https://nvd.nist.gov/vuln/detail/CVE-2025-66220)__: (CVSS score 8.1, High): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates with `OTHERNAME` SANs containing an embedded null byte as valid. - __[CVE-2025-64527](https://nvd.nist.gov/vuln/detail/CVE-2025-64527)__: (CVSS score 6.5, Medium): Envoy crashes when JWT authentication is configured with the remote JWKS fetching. - __[CVE-2025-64763](https://nvd.nist.gov/vuln/detail/CVE-2025-64763)__: (CVSS score 5.3, Medium): Potential request smuggling from early data after the CONNECT upgrade. ## General Changes - Built against upstream Istio version 1.27.4, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.4). ## Solo Flavor Changes - **Added** network configuration validation to `istioctl multicluster check`. - **Added** validation for the compatibility of intermediate certificates between peered clusters using `istioctl multicluster check`. - **Added** support for generating Gateway manifests for multiple contexts at once using `istioctl multicluster link --generate`. - **Fixed** an issue where the protocol was reset to TCP on global services after an istiod restart. When using waypoints, this could suddenly stop `HTTPRoutes` or other L7 policies from applying. - **Fixed** an issue where traffic would skip local waypoints when there were no healthy endpoints. The traffic will now fail. - **Fixed** an issue with peering with a flat network, when `istio.io/use-waypoint` was set on the namespace (in the local cluster), with Services in both the local and remote clusters, the Waypoint specified by the remote cluster incorrectly took precedence over what was specified in the local cluster. - **Fixed** an issue with peering with a flat network, when `istio.io/use-waypoint` was NOT set on the local cluster for a Service or Namespace, but remote clusters did specify it, we would use no waypoint at all. Now, if the local cluster doesn't specify anything, we will use information from the remote cluster. To intentionally skip using remote waypoints from the local cluster, set `istio.io/use-waypoint: none`. - **Fixed** an issue with flat-network peering not cleaning up stale endpoints from remote clusters. - **Fixed** a rare issue where peered service ports or other settings would get stuck in an incorrect state when the Service is created both locally and in a peered cluster in nearly identical timeframe. - **Fixed** an issue where sidecars and gateways did not respect load balancing settings or performing locality load balancing when sending to a waypoint. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.5-patch0 Fri, 30 Jan 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.5-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.5 and 1.27.5-patch0. ## Security Notice When using peered global services in sidecar environments, the generated Envoy cluster configuration was missing the `tlsMode: istio` transport socket match causing local sidecar-to-sidecar traffic to be sent as plaintext. In environments where strict mTLS was used, connectivity would break. ## General Changes - Built against upstream Istio version 1.27.5-patch0, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.5-patch0). - Built against upstream [Istio commit `199ed8c485d2eec26cb87c8863dfff6b0b2cc8b7`](https://github.com/istio/istio/commits/199ed8c485d2eec26cb87c8863dfff6b0b2cc8b7/). [Compare](https://github.com/istio/istio/compare/1.27.5..199ed8c485d2eec26cb87c8863dfff6b0b2cc8b7). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to show gateway addresses, peer cluster addresses, and globally shared services. - **Improved** `istioctl multicluster check` by skipping the stale workload check unless flat-network is detected. - **Added** support to retry failed remote peer creation or updates when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled. - **Fixed** an issue where the remote peer did not have its address updated when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled. - - **Fixed** an issue where istiod would generate invalid `WorkloadEntry` resources when remote services had unnamed ports. - **Fixed** east-west gateway TLS listeners showing an incorrect `UnsupportedProtocol` status when `PILOT_ENABLE_ALPHA_GATEWAY_API` was disabled. - **Fixed** an issue causing envoy clusters for peered global services to not have the tlsMode-istio transport socket configured. - **Fixed** an issue where the control plane did not immediately reconnect when the address in the istio-remote `Gateway` resource was updated. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.5 Mon, 22 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.5 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.3-patch0 and 1.27.4. ## Security Notice This build includes a fix of a CVE in the c-ares dependency of Envoy: - __[CVE-2025-62408](https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5)__: (CVSS score 5.9, Medium): Use after free due to connection being cleaned up after error. ## General Changes - Built against upstream Istio version 1.27.5, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.5). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.7 Wed, 18 Feb 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.7 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.5-patch0 and 1.27.7. ## Security Notice - [CVE-2025-61732](https://github.com/advisories/GHSA-8jvr-vh7g-f8gx) (CVSS score 8.6, High): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. - [CVE-2025-68121](https://github.com/advisories/GHSA-h355-32pf-p2xm) (CVSS score 4.8, Moderate): A flaw in `crypto/tls` session resumption allows resumed handshakes to succeed when they should fail if ClientCAs or RootCAs are mutated between the initial and resumed handshake. This can occur when using `Config.Clone` with mutations or `Config.GetConfigForClient`. As a result, clients may resume sessions with unintended servers, and servers may resume sessions with unintended clients. ## General Changes - Built against upstream [Istio commit `907c5bdcf7d00be35f7406904f1415dcbf0956a3`](https://github.com/istio/istio/commits/907c5bdcf7d00be35f7406904f1415dcbf0956a3/). [Compare](https://github.com/istio/istio/compare/199ed8c485d2eec26cb87c8863dfff6b0b2cc8b7..907c5bdcf7d00be35f7406904f1415dcbf0956a3). ## Solo Flavor Changes - **Added** support to retrieve connections from east-west gateway via the `istioctl ztunnel-config connections` subcommand. - **Added** enhanced validation checks in `istioctl multicluster check` for flat network configurations. - **Added** support for the east-west gateway to break connections to pods that are terminated. - **Added** the ability to specify authorized namespaces for debug endpoints when `ENABLE_DEBUG_ENDPOINT_AUTH=true`. Enable by setting `DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES` to a comma separated list of authorized namespaces. The system namespace (typically `istio-system`) is always authorized. - **Fixed** the `istioctl bootstrap` command to respect the `-i` istio system namespace flag. - **Fixed** the `istioctl ecs add-service` command to respect the `-i` istio system namespace flag. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.8-patch0 Wed, 01 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.8-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.27.8 and 1.27.8-patch0. ## Security Notice - **Envoy Transformation Filter CONNECT Request Crash**: (Severity: High): A vulnerability exists in Solo’s transformation filter. When a route or virtual host is configured with a transformation rule that includes a path-based request matcher, an unauthenticated attacker can send an HTTP CONNECT request, causing Envoy to crash. This is a potential Denial of Service (DoS) attack vector. The crash can be triggered only if you have a transformation with a path matcher defined. This is only possible with an `EnvoyFilter` with a transformation that includes a path matcher: ```yaml patch: operation: MERGE value: typed_per_filter_config: io.solo.transformation: "@type": "type.googleapis.com/transformation.options.gloo.solo.io.TransformationPerRoute" staged_transformations: regular: request_transforms: - matcher: prefix: '/' request_transformation: {} ``` ## General Changes - Built against upstream Istio commit `cc3c1929ae431003cd50b37b7ad2038c2cfa312d`. See the commit and history [here](https://github.com/istio/istio/commits/cc3c1929ae431003cd50b37b7ad2038c2cfa312d/). [Compare](https://github.com/istio/istio/compare/40831a0ac7554a7539d6b7cbc22a7f86591215f9...cc3c1929ae431003cd50b37b7ad2038c2cfa312d) ## Solo Flavor Changes - **Added** support for running `istioctl multicluster check` against extracted bug-report directories, enabling offline multicluster analysis without direct cluster access. - **Fixed** an issue where adding the traffic distribution annotation to a `Gateway` (waypoint) caused a restart. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.8 Wed, 11 Mar 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.8 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.7 and 1.27.8. ## Security Notice ### Envoy CVEs - __[CVE-2026-26308](https://nvd.nist.gov/vuln/detail/CVE-2026-26308)__: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header. - __[CVE-2026-26311](https://nvd.nist.gov/vuln/detail/CVE-2026-26311)__: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions. - __[CVE-2026-26310](https://nvd.nist.gov/vuln/detail/CVE-2026-26310)__: (CVSS score 5.9, Medium): Fixed a crash in `Utility::getAddressWithPort` when called with a scoped IPv6 address (e.g., `fe80::1%eth0`). - __[CVE-2026-26309](https://nvd.nist.gov/vuln/detail/CVE-2026-26309)__: (CVSS score 5.3, Medium): Fixed an off-by-one write in `JsonEscaper::escapeString()` that could corrupt the string null terminator. ### Istio CVEs - __[CVE-2026-31838](https://nvd.nist.gov/vuln/detail/CVE-2026-31838)__ / __[GHSA-974c-2wxh-g4ww](https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww)__: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access. - __[CVE-2026-31837](https://nvd.nist.gov/vuln/detail/CVE-2026-31837)__ / __[GHSA-v75c-crr9-733c](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)__: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys. ### Other Istio Security Fixes - **Fixed** XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration. - **Fixed** potential SSRF in `WasmPlugin` image fetching by validating bearer token realm URLs. - **Fixed** HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. ## General Changes - Built against upstream [Istio commit `40831a0ac7554a7539d6b7cbc22a7f86591215f9`](https://github.com/istio/istio/commits/40831a0ac7554a7539d6b7cbc22a7f86591215f9/). [Compare](https://github.com/istio/istio/compare/907c5bdcf7d00be35f7406904f1415dcbf0956a3..40831a0ac7554a7539d6b7cbc22a7f86591215f9). ## Solo Flavor Changes - **Added** a check to `istioctl multicluster check validation` to ensure all Istio proxy containers and all `sidecar-injector` `ConfigMap` templates have the `ISTIO_META_NETWORK` environment variable set to match the network label on the `istio-system` namespace. - **Added** check to `istioctl multicluster check` to verify `ambient.dnsCapture` is enabled in `istio-cni-config` `ConfigMap`. - **Added** check to `istioctl multicluster check` to verify `topology.istio.io/cluster` label is present and valid on istio-remote gateways. - **Fixed** the `istioctl multicluster check` pod check to dynamically discover eastwest gateway names from `Gateway` objects instead of hardcoding `istio-eastwest`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.9-patch0 Fri, 05 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.9-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.27.9 and 1.27.9-patch0. ## Security Notice ### Envoy CVEs - __[CVE-2026-47774](https://nvd.nist.gov/vuln/detail/CVE-2026-47774)__ / __[GHSA-22m2-hvr2-xqc8](https://github.com/istio/istio/security/advisories/GHSA-22m2-hvr2-xqc8)__: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service. ## General Changes - Built against upstream Istio version 1.27.9, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.9). ## Solo Flavor Changes - **Fixed** an issue where the ECS controller did not respect custom system namespace configurations, now properly using the configured namespace instead of defaulting to `istio-system`. - **Fixed** an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected. - **Fixed** traffic routing failures for global services that use named `targetPort` values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports. - **Fixed** duplicate target port mappings that caused `ServiceEntry` validation failures. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.9-patch1 Wed, 24 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.9-patch1 patch release.

This release note describes what's different between Solo builds of Istio versions 1.27.9-patch0 and 1.27.9-patch1. ## Security Notice ### Envoy CVEs The following security fixes were backported (see [ISTIO-SECURITY-2026-005](https://istio.io/latest/news/security/istio-security-2026-005/)): - __[GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch)__: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition. - __[CVE-2026-47204](https://nvd.nist.gov/vuln/detail/CVE-2026-47204)__: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route. - __[CVE-2026-47205](https://nvd.nist.gov/vuln/detail/CVE-2026-47205)__: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check. - __[CVE-2026-47207](https://nvd.nist.gov/vuln/detail/CVE-2026-47207)__: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy. - __[CVE-2026-47221](https://nvd.nist.gov/vuln/detail/CVE-2026-47221)__: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault. - __[CVE-2026-47692](https://nvd.nist.gov/vuln/detail/CVE-2026-47692)__: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host. - __[CVE-2026-47775](https://nvd.nist.gov/vuln/detail/CVE-2026-47775)__: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter's AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a `gcm.` algorithm marker, which authenticates the ciphertext and removes the oracle. - __[CVE-2026-47778](https://nvd.nist.gov/vuln/detail/CVE-2026-47778)__: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions. - __[CVE-2026-48042](https://nvd.nist.gov/vuln/detail/CVE-2026-48042)__: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the `envoy.reloadable_features.limit_json_parser_nesting_depth` to `false`. - __[CVE-2026-48044](https://nvd.nist.gov/vuln/detail/CVE-2026-48044)__: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the `MaxInflateRatio` limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single `process()` call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached. - __[CVE-2026-48090](https://nvd.nist.gov/vuln/detail/CVE-2026-48090)__: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (`onDestroy()` had been called), which could lead to accessing dangling pointers and result in UAF/crash. - __[CVE-2026-48497](https://nvd.nist.gov/vuln/detail/CVE-2026-48497)__: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use `ENVOY_BUG` in case the sanity check fails. - __[CVE-2026-48706](https://nvd.nist.gov/vuln/detail/CVE-2026-48706)__: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name. - __[CVE-2026-48743](https://nvd.nist.gov/vuln/detail/CVE-2026-48743)__: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard `envoy.reloadable_features.quic_validate_headers_only_content_length`. ## General Changes - Built against upstream [Istio commit `b9159ca3e5d56b05f69f3a58d687b8767d5639dd`](https://github.com/istio/istio/commits/b9159ca3e5d56b05f69f3a58d687b8767d5639dd/). This is a proxy-only security backport; the upstream Istio commit is unchanged from 1.27.9-patch0. ## Solo Flavor Changes - **Fixed** sidecar waypoint interop to reduce control plane memory consumption. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.9-patch2 Mon, 31 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.9-patch2 patch release.

This release note describes what's different between Solo builds of Istio versions 1.27.9-patch1 and 1.27.9-patch2. ## Security Notice ### Envoy CVEs The following security fixes were backported (see [ISTIO-SECURITY-2026-006](https://istio.io/latest/news/security/istio-security-2026-006/)): - __[CVE-2026-73513](https://nvd.nist.gov/vuln/detail/CVE-2026-73513)__: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the `END_STREAM` flag to an Envoy instance using `oghttp2`, corrupting stream state and terminating the process. - __[CVE-2026-73552](https://nvd.nist.gov/vuln/detail/CVE-2026-73552)__: (CVSS score 7.5): Fixed an issue where `safe_regex` matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. - __[CVE-2026-73512](https://nvd.nist.gov/vuln/detail/CVE-2026-73512)__: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. - __[CVE-2026-73547](https://nvd.nist.gov/vuln/detail/CVE-2026-73547)__: (CVSS score 7.5): Fixed an abnormal process termination in the `ext_authz` filter when processing CONNECT requests without a `:path` pseudo-header. - __[CVE-2026-73549](https://nvd.nist.gov/vuln/detail/CVE-2026-73549)__: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. - __[CVE-2026-50572](https://nvd.nist.gov/vuln/detail/CVE-2026-50572)__: (CVSS score 5.9): Fixed a use-after-free in the `ext_authz` raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. - __[CVE-2026-73546](https://nvd.nist.gov/vuln/detail/CVE-2026-73546)__: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (`/stats?format=html`) where dynamically named statistics could introduce attacker-controlled content. - __[CVE-2026-48521](https://nvd.nist.gov/vuln/detail/CVE-2026-48521)__: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection. - __[CVE-2026-73551](https://nvd.nist.gov/vuln/detail/CVE-2026-73551)__: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. - __[CVE-2026-73511](https://nvd.nist.gov/vuln/detail/CVE-2026-73511)__: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. - __[CVE-2026-73548](https://nvd.nist.gov/vuln/detail/CVE-2026-73548)__: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. - __[CVE-2026-73550](https://nvd.nist.gov/vuln/detail/CVE-2026-73550)__: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. - __[CVE-2026-73553](https://nvd.nist.gov/vuln/detail/CVE-2026-73553)__: (CVSS score 7.5): Fixed an authorization bypass when `ignore_path_parameters_in_path_matching` was enabled, where a path such as `/admin;x` could bypass an RBAC policy for `/admin` while still reaching the protected route. ### Istio CVEs - __[GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx)__: (CVSS score 6.8): Fixed `BackendTLSPolicy` failing open on sidecar proxies. When the policy's `caCertificateRefs` could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected. ### Istio security fixes - **Fixed** a control plane denial of service via the `EnvoyFilter` `proxyVersion` match expression (`spec.configPatches[].match.proxy.proxyVersion`), which accepted a regular expression of unbounded length. A user able to create `EnvoyFilter` resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters. ## General Changes - Built against upstream [Istio commit `b9159ca3e5d56b05f69f3a58d687b8767d5639dd`](https://github.com/istio/istio/commits/b9159ca3e5d56b05f69f3a58d687b8767d5639dd/). The upstream Istio commit is unchanged from 1.27.9-patch1. ## Solo Flavor Changes - **Fixed** ztunnel to report the correct egress policies. - **Fixed** ztunnel chart examples for `egressPolicies`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.27.9 Tue, 14 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.27.9 patch release.

This release note describes what's different between Solo builds of Istio versions 1.27.8-patch0 and 1.27.9. ## Security Notice This release bumps the Go version to 1.25.9, which includes fixes for the following security vulnerabilities in the Go `crypto` packages: - **[CVE-2026-32280](https://github.com/golang/go/issues/78282)** (CVSS 7.5, High) (`crypto/x509`): During chain building, the amount of work performed is not correctly limited when a large number of intermediate certificates are passed in `VerifyOptions.Intermediates`, which can lead to a denial of service. This affects both direct users of `crypto/x509` and users of `crypto/tls`. - **[CVE-2026-32281](https://github.com/golang/go/issues/78281)** (Unscored, Undergoing Analysis) (`crypto/x509`): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains. - **[CVE-2026-32283](https://github.com/golang/go/issues/78334)** (Unscored, Undergoing Analysis) (`crypto/tls`): If one side of a TLS 1.3 connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. - **[CVE-2026-33810](https://github.com/golang/go/issues/78332)** (Unscored, Undergoing Analysis) (`crypto/x509`): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs that use a different case than the constraint. For example, if a certificate contains the DNS name `*.example.com` and the excluded DNS name `EXAMPLE.COM`, the constraint will not be applied. This only affects validation of otherwise trusted certificate chains. ## General Changes - Built against upstream Istio version 1.27.9, release note can be found [here](https://istio.io/latest/news/releases/1.27.x/announcing-1.27.9). - Built against upstream Istio commit `COMMIT`. See the commit and history [here](https://github.com/istio/istio/commits/XXXXXXXXXXXXX/). ## Solo Flavor Changes - **Added** a `--revision` (`-r`) flag to `istioctl bootstrap`, allowing users to target a specific control plane revision. When set, the command looks up `istiod-{revision}` instead of the default `istiod` service. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.0-patch0 Mon, 24 Nov 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.0-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.0 and 1.28.0-patch0. ## General Changes - Built against upstream [Istio commit `58e3a8858ba42d5a5633c321d335c0ba95247b67`](https://github.com/istio/istio/commits/58e3a8858ba42d5a5633c321d335c0ba95247b67/). [Compare](https://github.com/istio/istio/compare/1bbe8a0e88b1cc1f8217408192b54ee374edc479..58e3a8858ba42d5a5633c321d335c0ba95247b67). ## Solo Flavor Changes - **Added** a new CLI option, `--data-plane-service-type`, to the`istioctl multicluster expose` command. This option allows specifying a comma-delimited list of the dataplane service types that peers can use to connect with the exposed gateway. Valid values are: `loadbalancer` or `nodeport`, with the default being `loadbalancer`. - **Added** a new CLI option, `--preferred-data-plane-service-type`, to the`istioctl multicluster link` command. This option allows specifying the preferred dataplane service type to use when peering with the remote cluster. Valid values are: `loadbalancer` or `nodeport`, with the default being `loadbalancer`. - **Added** support for generating `Gateway` manifests for multiple contexts at once using `istioctl multicluster link --generate`. - **Fixed** an issue where traffic would skip local waypoints when there were no healthy endpoints. The traffic will now fail. - **Fixed** an issue when draining is enabled and no cluster name is found. A warning is now issued. - **Fixed** an issue where `ServiceInfo` events were not propagated after its `HboneNodePort` field changed. This caused NodePort peering to be broken when a gateway was annotated after its initial creation. - **Fixed** an issue where the status field on Segment resources was not updating. - **Fixed** an issue where the `istioctl ecs add-service` command incorrectly reported that a task definition did not have an `executionRoleArn` defined. - **Removed** the explicit requirement for specifying an HBONE listener on an istio-remote gateway resource. If an istio-remote gateway's preferred dataplane service type is `loadbalancer`, a network gateway is created with the well-known HBONE port value 15008. Backwards compatibility is maintained by still allowing an HBONE listener to be specified on an istio-remote gateway resource. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.0 Thu, 13 Nov 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.27.0 and 1.28.0. ## General Changes - Built against upstream [Istio commit `1bbe8a0e88b1cc1f8217408192b54ee374edc479`](https://github.com/istio/istio/commits/1bbe8a0e88b1cc1f8217408192b54ee374edc479/). [Compare](https://github.com/istio/istio/compare/1.27.0..1bbe8a0e88b1cc1f8217408192b54ee374edc479). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` with the following enhancements: - Check the `gloo.solo.io/PeeringSucceeded` remote gateway condition for installations below 1.27 - Find stale endpoints from remote clusters that point to Pods that no longer exist - Check that the environment variables on istiod do not conflict with multi-cluster functionality - **Added** the ability to mark a cluster as draining. - The annotation, `solo.io/draining-weight: `, specifies the amount of traffic to drain - The annotation can be set on: 1. the `istio-eastwest` gateway to prevent inbound traffic from remote clusters 2. the `istio-remote` gateway to prevent outbound traffic to the remote cluster - If a weight is set on both the `istio-eastwest` and `istio-remote` gateways for a given cluster, the maximum weight is applied - **Improved** the `solo.io/service-scope` label semantics to control service visibility within the mesh. You can apply this label to namespaces or individual services, with labels on individual services taking precedence over the namespace label. Service takeover is now separated from scope and has been extracted to a dedicated `solo.io/service-takeover: true|false` (default: false) label. The takeover label only has effect within the same segment, even if scope is set to global. You can choose between the following scope values: - `cluster` to limit service visibility to apps within the same cluster. This can be useful to opt out individual services from being globally available if the entire namespace's scope is set to `global`. - `segment` to limit service visibility to apps within the same segment. - `global` to make services available across all peered clusters. - `global-only` has been deprecated in favor of using `solo.io/service-takeover` for service takeover use cases, but will still work. - **Added** a new CRD, `Segment`, allowing clusters to declare a custom domain suffix and allow addressing individual groups of clusters. - **Added** an environment variable to istiod, `DISABLE_LEGACY_MULTICLUSTER`, to disable legacy OSS multicluster discovery mechanisms that use remote secrets. OSS multicluster uses remote secrets (containing kubernetes configurations) to watch resources on remote clusters, which is fundamentally incompatible with peering's decentralized, push-based model. This variable ensures istiod ignores remote secrets and doesn't attempt to set up Kubernetes clients to connect to them. When migrating from legacy OSS multicluster to peering, set this on the new revision of the control plane. For installations without remote secrets, this serves as a recommended safety measure. - **Added** multi-cluster and cross-account support to ECS platform discovery. - **Added** support for peering multiple clusters using NodePort `istio-eastwest` gateway services: - You can enable this feature with the following annotations: - `peering.solo.io/data-plane-service-type: NodePort` on the `istio-eastwest` gateway resource, propagated to the corresponding Kubernetes service. - `peering.solo.io/preferred-data-plane-service-type: NodePort` on the `istio-remote` gateway resource. - When peering via NodePort is enabled, only nodes where an `istio-eastwest` gateway pod is provisioned will be considered targets for traffic. - Like LoadBalancer gateways, NodePort gateways support traffic from Envoy-based ingress gateways, waypoints, and sidecars. - A new gateway status condition indicates what data plane service type is currently being used for peering. - **Fixed** a race condition that occasionally missed global Services when peering from remote clusters. - **Fixed** changes to Service resources not being propagated to their associated global services. - **Fixed** an issue where any external modification of auto-generated resources for multi-cluster peering are restored to their original state. - **Fixed** an issue where a service only existing in a remote cluster would not have an L7 policy properly applied if the remote service did not properly declare an L7 protocol via the port name or `appProtocol` field. - **Fixed** an issue where Services with `solo.io/service-scope=global-only` were not reachable via standard Kubernetes service hostnames, regardless of whether the local cluster had a copy of the Service or not. - **Fixed** a race condition where gateway status updates were conflicting with gateway updates. Retries are now attempted when an error occurs. - **Fixed** an istiod crash when supplying a license to a FIPS-compliant version using a license secret. - **Fixed** an issue where deleting a remote service did not delete the corresponding ServiceEntry in the local cluster. - **Fixed** protocol being reset to TCP on global services after an istiod restart. When using waypoints, this could suddenly stop `HTTPRoutes` or other L7 policies from applying. - **Fixed** an issue where "to-workload" traffic through a waypoint would fail when peering is enabled (regardless of actual multi-cluster installation or traffic). - **Fixed** traffic routing through the local cluster's waypoint proxy when a service exists only on a remote cluster, but the same waypoint is also deployed remotely. Traffic now correctly routes to remote waypoint proxies when the service only exists remotely. - **Fixed** traffic breaking when a waypoint from the local cluster was deleted while one still existed in the remote cluster. - **Fixed** an issue with connections to `istio-eastwest` gateways from Envoy proxies (sidecar, waypoint, ingress) where the outer HBONE connection used port 15008 rather than the HBONE port specified in the `istio-remote` gateway. This presented a problem when specifying NodePort `istio-eastwest` gateways. - **Fixed** missing gateway reconciliation for service-type changes. - **Fixed** invalid ServiceEntry generation when the service port is not named. - **Fixed** locality information not being propagated for peered multi-cluster resources when the `istio-remote` Gateway's `topology.istio.io/subzone` was specified. - **Fixed** ambient workloads attempting to send HBONE to plaintext workloads on other clusters when using a flat-network multicluster setup. - **Fixed** an issue with flat networking where traffic would not traverse remote-only waypoints. - **Fixed** an issue with peering with a flat network for the case when the `istio.io/use-waypoint` label was set on a namespace in the local cluster that had services in both the local and remote clusters. In these cases, the waypoint specified by the remote cluster incorrectly took precedence over what was specified in the local cluster. - **Fixed** an issue with peering with a flat network for the case when the `istio.io/use-waypoint` label was NOT set on the local cluster for a service or namespace, but remote clusters did have the label. In such cases, no waypoint was used at all. Now, if the local cluster doesn't set the label, the information from the remote cluster is used. To intentionally skip using remote waypoints from the local cluster, set `istio.io/use-waypoint: none`. - **Fixed** an issue with flat-network peering where stale endpoints were not properly cleaned up from remote clusters. - **Fixed** an issue where an incorrect trust domain was set on peered flat-networking workloads. - **Fixed** a rare issue where peered service ports or other settings would get stuck in an incorrect state when the Service is created both locally and in a peered cluster in a nearly identical timeframe. - **Fixed** sidecars and gateways not respecting load balancing settings or performing locality load balancing when sending traffic to a waypoint. - **Fixed** local `istio-eastwest` gateways not being translated into `NetworkGateway`s when the cluster name matched the network ID. - **Removed** incorrect `UnsupportedProtocol` warning from `istio-eastwest` Gateway resources. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.1-patch0 Mon, 08 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.1-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.1 and 1.28.1-patch0. ## General Changes - Built against upstream [Istio commit `76dffd9e3f54ed697dff9403ef3724abcc57e899`](https://github.com/istio/istio/commits/76dffd9e3f54ed697dff9403ef3724abcc57e899/). [Compare](https://github.com/istio/istio/compare/1.28.1..76dffd9e3f54ed697dff9403ef3724abcc57e899). ## Solo Flavor Changes - **Fixed** NodePort peering selection of node IP address types. Only internal IP addresses are now considered. - **Fixed** an istiod crashing bug that could occur when attempting to use Waypoint interop with Sidecar and Gateway proxies. - **Fixed** istiod generating invalid `WorkloadEntry` resources when remote services had unnamed ports. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.1 Thu, 04 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.1 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.0-patch0 and 1.28.1. ## Security Notice This build includes a fix of Envoy CVEs: - __[CVE-2025-66220](https://nvd.nist.gov/vuln/detail/CVE-2025-66220)__: (CVSS score 8.1, High): TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates with `OTHERNAME` SANs containing an embedded null byte as valid. - __[CVE-2025-64527](https://nvd.nist.gov/vuln/detail/CVE-2025-64527)__: (CVSS score 6.5, Medium): Envoy crashes when JWT authentication is configured with the remote JWKS fetching. - __[CVE-2025-64763](https://nvd.nist.gov/vuln/detail/CVE-2025-64763)__: (CVSS score 5.3, Medium): Potential request smuggling from early data after the CONNECT upgrade. ## General Changes - Built against upstream Istio version 1.28.1, release note can be found [here](https://istio.io/latest/news/releases/1.28.x/announcing-1.28.1). ## Solo Flavor Changes - **Added** network configuration validation to `istioctl multicluster check`. - **Added** validation for the compatibility of intermediate certificates between peered clusters using `istioctl multicluster check`. - **Fixed** an issue encountered during upgrades from 1.27, where `WorkloadEntry` resources for Pods in remote clusters were not reachable on the same network. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.10-patch0 Mon, 31 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.10-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.10 and 1.28.10-patch0. ## Security Notice ### Envoy CVEs The following security fixes were backported (see [ISTIO-SECURITY-2026-006](https://istio.io/latest/news/security/istio-security-2026-006/)): - __[CVE-2026-73513](https://nvd.nist.gov/vuln/detail/CVE-2026-73513)__: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the `END_STREAM` flag to an Envoy instance using `oghttp2`, corrupting stream state and terminating the process. - __[CVE-2026-73552](https://nvd.nist.gov/vuln/detail/CVE-2026-73552)__: (CVSS score 7.5): Fixed an issue where `safe_regex` matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. - __[CVE-2026-73512](https://nvd.nist.gov/vuln/detail/CVE-2026-73512)__: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. - __[CVE-2026-73547](https://nvd.nist.gov/vuln/detail/CVE-2026-73547)__: (CVSS score 7.5): Fixed an abnormal process termination in the `ext_authz` filter when processing CONNECT requests without a `:path` pseudo-header. - __[CVE-2026-73549](https://nvd.nist.gov/vuln/detail/CVE-2026-73549)__: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. - __[CVE-2026-50572](https://nvd.nist.gov/vuln/detail/CVE-2026-50572)__: (CVSS score 5.9): Fixed a use-after-free in the `ext_authz` raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. - __[CVE-2026-73546](https://nvd.nist.gov/vuln/detail/CVE-2026-73546)__: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (`/stats?format=html`) where dynamically named statistics could introduce attacker-controlled content. - __[CVE-2026-48521](https://nvd.nist.gov/vuln/detail/CVE-2026-48521)__: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection. - __[CVE-2026-73551](https://nvd.nist.gov/vuln/detail/CVE-2026-73551)__: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. - __[CVE-2026-73511](https://nvd.nist.gov/vuln/detail/CVE-2026-73511)__: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. - __[CVE-2026-73548](https://nvd.nist.gov/vuln/detail/CVE-2026-73548)__: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. - __[CVE-2026-73550](https://nvd.nist.gov/vuln/detail/CVE-2026-73550)__: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. - __[CVE-2026-73553](https://nvd.nist.gov/vuln/detail/CVE-2026-73553)__: (CVSS score 7.5): Fixed an authorization bypass when `ignore_path_parameters_in_path_matching` was enabled, where a path such as `/admin;x` could bypass an RBAC policy for `/admin` while still reaching the protected route. ### Istio CVEs - __[GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx)__: (CVSS score 6.8): Fixed `BackendTLSPolicy` failing open on sidecar proxies. When the policy's `caCertificateRefs` could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected. ### Istio security fixes - **Fixed** a control plane denial of service via the `EnvoyFilter` `proxyVersion` match expression (`spec.configPatches[].match.proxy.proxyVersion`), which accepted a regular expression of unbounded length. A user able to create `EnvoyFilter` resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters. ## General Changes - Built against upstream [Istio commit `cc7804f80f656cf9ccf61ec9b7159b309f69982e`](https://github.com/istio/istio/commits/cc7804f80f656cf9ccf61ec9b7159b309f69982e/). [Compare](https://github.com/istio/istio/compare/ff49c1889ebad8d444b8f82425a2fd326c039e54..cc7804f80f656cf9ccf61ec9b7159b309f69982e). ## Solo Flavor Changes - **Fixed** ztunnel to report the correct egress policies. - **Fixed** ztunnel chart examples for `egressPolicies`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.10 Thu, 02 Jul 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.10 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.9 and 1.28.10. ## General Changes - Built against upstream [Istio commit `ff49c1889ebad8d444b8f82425a2fd326c039e54`](https://github.com/istio/istio/commits/ff49c1889ebad8d444b8f82425a2fd326c039e54/). [Compare](https://github.com/istio/istio/compare/178a15c6a13651a3b970f0bd4b7534439f0a2678..ff49c1889ebad8d444b8f82425a2fd326c039e54). ## Solo Flavor Changes - **Fixed** traffic routing for global services using a waypoint that have both in-network and cross-network backing services. Traffic will always go through the waypoint instead of bypassing it inconsistently. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.2 Tue, 23 Dec 2025 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.2 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.1-patch0 and 1.28.2. ## Security Notice This build includes a fix of a CVE in the c-ares dependency of Envoy: - __[CVE-2025-62408](https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5)__: (CVSS score 5.9, Medium): Use after free due to connection being cleaned up after error. ## General Changes - Built against upstream [Istio commit `5ee02944487b3047e7a637309829834ae36b186b`](https://github.com/istio/istio/commits/5ee02944487b3047e7a637309829834ae36b186b/). [Compare](https://github.com/istio/istio/compare/76dffd9e3f54ed697dff9403ef3724abcc57e899..5ee02944487b3047e7a637309829834ae36b186b). ## Solo Flavor Changes - **Improved** `istioctl` command help descriptions and examples with clearer guidance for `bootstrap`, `ecs service-add`, `multicluster check`, `multicluster expose`, and `multicluster link` commands. - **Added** a mesh-wide escape hatch based on port matching for outbound traffic being impacted by ztunnel capture. Configure via `AMBIENT_EXCLUDE_OUTBOUND_PORTS` environment variable (for example, `AMBIENT_EXCLUDE_OUTBOUND_PORTS="1443,16000-16010"`). ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.3-patch0 Fri, 30 Jan 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.3-patch0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.3 and 1.28.3-patch0. ## Security Notice When using peered global services in sidecar environments, the generated Envoy cluster configuration was missing the `tlsMode: istio` transport socket match causing local sidecar-to-sidecar traffic to be sent as plaintext. In environments where strict mTLS was used, connectivity would break. ## General Changes - Built against upstream [Istio commit `1eed297fa93eb92203d5e934a8d9f22573202fac`](https://github.com/istio/istio/commits/1eed297fa93eb92203d5e934a8d9f22573202fac/). [Compare](https://github.com/istio/istio/compare/fea0e6ad9627a241a299afcd793a3da000e18f1b..1eed297fa93eb92203d5e934a8d9f22573202fac). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to show gateway addresses, peer cluster addresses, and globally shared services. - **Added** ztunnel helm support for `dnsPolicy` and `dnsConfig` customization. - **Fixed** an issue where traffic was sent to pods peered for flat-network multi-cluster which were `Not Ready` or `Terminating`. - **Fixed** an issue in NodePort peering where a comma-delimited value for the solo annotation `peering.solo.io/data-plane-service-type` would prevent node workloads from being sent to peers. - **Fixed** an issue causing envoy clusters for peered global services to not have the tlsMode-istio transport socket configured. - **Fixed** an issue in NodePort peering where the generated `ServiceEntry` and node `WorkloadEntry` resources fail to be cleaned up when the istio-remote gateway's `peering.solo.io/preferred-data-plane-service-type` annotation was no longer set to "NodePort". - **Fixed** an issue where the control plane did not immediately reconnect when the address in the istio-remote `Gateway` resource was updated. - **Fixed** an issue where node `WorkloadEntry` resources failed to be created when NodePort peering was enabled after the peer initially connected via a `LoadBalancer` for an extended period of time. Node events received before the NodePort `ServiceEntry` existed were eventually dropped and never re-processed once NodePort peering was enabled. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.3 Wed, 21 Jan 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.2 and 1.28.3. ## General Changes - Built against upstream [Istio commit `fea0e6ad9627a241a299afcd793a3da000e18f1b`](https://github.com/istio/istio/commits/fea0e6ad9627a241a299afcd793a3da000e18f1b/). [Compare](https://github.com/istio/istio/compare/1.28.2..fea0e6ad9627a241a299afcd793a3da000e18f1b). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` command by skipping the stale workload check unless flat-network is detected. - **Added** support to retry failed remote peer creation or updates when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled. - **Fixed** an issue where the remote peer did not have its address updated when `PEERING_AUTOMATIC_LOCAL_GATEWAY` was enabled. - **Fixed** an issue in NodePort peering where a node that entered a `NotReady` state was still used for multi-cluster traffic routing. - **Fixed** east-west gateway TLS listeners showing an incorrect `UnsupportedProtocol` status when `PILOT_ENABLE_ALPHA_GATEWAY_API` was disabled. - **Fixed** flat-network multi-cluster peering to properly peer user `WorkloadEntry`-based endpoints across clusters for multi-cluster traffic. This fixes VMs and external workloads being reachable for proxies configured by control planes in different clusters. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.4 Wed, 18 Feb 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.4 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.3 and 1.28.4. ## Security Notice - [CVE-2025-61732](https://github.com/advisories/GHSA-8jvr-vh7g-f8gx) (CVSS score 8.6, High): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. - [CVE-2025-68121](https://github.com/advisories/GHSA-h355-32pf-p2xm) (CVSS score 4.8, Moderate): A flaw in `crypto/tls` session resumption allows resumed handshakes to succeed when they should fail if ClientCAs or RootCAs are mutated between the initial and resumed handshake. This can occur when using `Config.Clone` with mutations or `Config.GetConfigForClient`. As a result, clients may resume sessions with unintended servers, and servers may resume sessions with unintended clients. ## General Changes - Built against upstream [Istio commit `4ae866ba2a361ecfa4de835136c13895437364d0`](https://github.com/istio/istio/commits/fea0e6ad9627a241a299afcd793a3da000e18f1b/). [Compare](https://github.com/istio/istio/compare/fea0e6ad9627a241a299afcd793a3da000e18f1b..4ae866ba2a361ecfa4de835136c13895437364d0). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to show gateway addresses, peer cluster addresses, and globally shared services. - **Added** ztunnel helm support for `dnsPolicy` and `dnsConfig` customization. - **Added** support to retrieve connections from east-west gateway via the `istioctl ztunnel-config connections` subcommand. - **Added** enhanced validation checks in `istioctl multicluster check` for flat-network configurations. - **Added** support for the east-west gateway to break connections to pods that are terminated. - **Added** the ability to specify authorized namespaces for debug endpoints when `ENABLE_DEBUG_ENDPOINT_AUTH=true`. Enable by setting `DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES` to a comma separated list of authorized namespaces. The system namespace (typically `istio-system`) is always authorized. - **Fixed** sending traffic to pods peered for flat-network multi-cluster which are `Not Ready` or `Terminating`. - **Fixed** an issue in NodePort peering where a comma-delimited value for the Solo annotation `peering.solo.io/data-plane-service-type` would prevent node workloads from being sent to peers. - **Fixed** an issue causing Envoy clusters for peered global services to not have the `tlsMode-istio` transport socket configured. - **Fixed** an issue in NodePort peering where simultaneous processing of node `WorkloadEntry` and gateway-derived `ServiceEntry` delete events could cause the node `WorkloadEntry` to persist. - **Fixed** an issue in NodePort peering where the generated `ServiceEntry` and node `WorkloadEntry` fail to be cleaned up when the istio-remote gateway's `peering.solo.io/preferred-data-plane-service-type` annotation was no longer set to `NodePort`. - **Fixed** an issue where updating the address in the istio-remote Gateway resource would not prompt the control plane to connect to the new address. - **Fixed** the `istioctl bootstrap` command to respect the `-i` istio system namespace flag. - **Fixed** the `istioctl ecs add-service` command to respect the `-i` istio system namespace flag. - **Fixed** an issue where node `WorkloadEntry` resources failed to be created when NodePort peering was enabled after the peer initially connected via LoadBalancer for an extended period of time. Node events received before the NodePort `ServiceEntry` existed were eventually dropped and never re-processed once NodePort peering was enabled. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.5-patch0 Thu, 02 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.5-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.5 and 1.28.5-patch0. ## Security Notice - **Envoy Transformation Filter CONNECT Request Crash**: (Severity: High): A vulnerability exists in Solo's transformation filter. When a route or virtual host is configured with a transformation rule that includes a path-based request matcher, an unauthenticated attacker can send an HTTP CONNECT request, causing Envoy to crash. This is a potential Denial of Service (DoS) attack vector. The crash can be triggered only if you have a transformation with a path matcher defined. This is only possible with an `EnvoyFilter` with a transformation that includes a path matcher: ```yaml patch: operation: MERGE value: typed_per_filter_config: io.solo.transformation: "@type": "type.googleapis.com/transformation.options.gloo.solo.io.TransformationPerRoute" staged_transformations: regular: request_transforms: - matcher: prefix: '/' request_transformation: {} ``` ## General Changes - Built against upstream [Istio commit `0a4f135afc0260487053ae1f8548ac7cbb973b6a`](https://github.com/istio/istio/commits/0a4f135afc0260487053ae1f8548ac7cbb973b6a/). [Compare](https://github.com/istio/istio/compare/58f61455f0368f692834cb06c8ca6a170e83ba84..0a4f135afc0260487053ae1f8548ac7cbb973b6a). ## Solo Flavor Changes - **Added** a new environment variable `PEERING_EXCLUDED_METADATA` that defines a comma-delimited string of labels and annotations which are excluded from auto-generated peering resources' metadata. - **Added** support for running `istioctl multicluster check` against extracted bug-report directories, enabling offline multicluster analysis without direct cluster access. - **Fixed** an issue where adding the draining annotation to the East-West `Gateway` caused a restart. **Fixed** an issue where adding the traffic distribution annotation to a `Gateway` (waypoint) caused a restart. - **Fixed** an issue where adding a service-type annotation to the East-West `Gateway` caused a restart. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.5 Wed, 11 Mar 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.5 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.4 and 1.28.5. ## Security Notice ### Envoy CVEs - __[CVE-2026-26308](https://nvd.nist.gov/vuln/detail/CVE-2026-26308)__: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header. - __[CVE-2026-26311](https://nvd.nist.gov/vuln/detail/CVE-2026-26311)__: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions. - __[CVE-2026-26310](https://nvd.nist.gov/vuln/detail/CVE-2026-26310)__: (CVSS score 5.9, Medium): Fixed a crash in `Utility::getAddressWithPort` when called with a scoped IPv6 address (e.g., `fe80::1%eth0`). - __[CVE-2026-26309](https://nvd.nist.gov/vuln/detail/CVE-2026-26309)__: (CVSS score 5.3, Medium): Fixed an off-by-one write in `JsonEscaper::escapeString()` that could corrupt the string null terminator. - __[CVE-2026-26330](https://nvd.nist.gov/vuln/detail/CVE-2026-26330)__: (CVSS score 5.3, Medium): Fixed a bug in the gRPC rate limit client that could lead to potential use-after-free issues. Only affects Istio 1.28 and 1.29. ### Istio CVEs - __[CVE-2026-31838](https://nvd.nist.gov/vuln/detail/CVE-2026-31838)__ / __[GHSA-974c-2wxh-g4ww](https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww)__: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access. - __[CVE-2026-31837](https://nvd.nist.gov/vuln/detail/CVE-2026-31837)__ / __[GHSA-v75c-crr9-733c](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)__: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys. ### Other Istio Security Fixes - **Fixed** XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration. - **Fixed** potential SSRF in `WasmPlugin` image fetching by validating bearer token realm URLs. - **Fixed** HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. ## General Changes - Built against upstream [Istio commit `58f61455f0368f692834cb06c8ca6a170e83ba84`](https://github.com/istio/istio/commits/58f61455f0368f692834cb06c8ca6a170e83ba84/). [Compare](https://github.com/istio/istio/compare/4ae866ba2a361ecfa4de835136c13895437364d0..58f61455f0368f692834cb06c8ca6a170e83ba84). ## Solo Flavor Changes - **Added** a check to `istioctl multicluster check validation` to ensure all Istio proxy containers and all `sidecar-injector` `ConfigMap` templates have the `ISTIO_META_NETWORK` environment variable set to match the network label on the `istio-system` namespace. - **Added** check to `istioctl multicluster check` to verify `ambient.dnsCapture` is enabled in `istio-cni-config` `ConfigMap`. - **Added** check to `istioctl multicluster check` to verify `topology.istio.io/cluster` label is present and valid on istio-remote gateways. - **Fixed** the `istioctl multicluster check` pod check to dynamically discover eastwest gateway names from `Gateway` objects instead of hardcoding `istio-eastwest`. - **Fixed** an issue where, when waypoint interop was enabled, ingress gateways applied the waypoint's `DestinationRule` instead of the service's own `DestinationRule` regardless of whether the service had the `istio.io/ingress-use-waypoint` label set. The label is now correctly honored. - **Fixed** `ingress-use-waypoint` label propagation from namespace to federated service. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.6 Wed, 15 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.6 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.5-patch0 and 1.28.6. ## Security Notice This release bumps the Go version to 1.25.9, which includes fixes for the following security vulnerabilities in the Go `crypto` packages: - **[CVE-2026-32280](https://github.com/golang/go/issues/78282)** (CVSS 7.5, High) (`crypto/x509`): During chain building, the amount of work performed is not correctly limited when a large number of intermediate certificates are passed in `VerifyOptions.Intermediates`, which can lead to a denial of service. This affects both direct users of `crypto/x509` and users of `crypto/tls`. - **[CVE-2026-32281](https://github.com/golang/go/issues/78281)** (Unscored, Undergoing Analysis) (`crypto/x509`): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains. - **[CVE-2026-32283](https://github.com/golang/go/issues/78334)** (Unscored, Undergoing Analysis) (`crypto/tls`): If one side of a TLS 1.3 connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. - **[CVE-2026-33810](https://github.com/golang/go/issues/78332)** (Unscored, Undergoing Analysis) (`crypto/x509`): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs that use a different case than the constraint. For example, if a certificate contains the DNS name `*.example.com` and the excluded DNS name `EXAMPLE.COM`, the constraint will not be applied. This only affects validation of otherwise trusted certificate chains. ## General Changes - Built against upstream Istio version 1.28.6, release note can be found [here](https://istio.io/latest/news/releases/1.28.x/announcing-1.28.6). - Built against upstream Istio commit `COMMIT`. See the commit and history [here](https://github.com/istio/istio/commits/XXXXXXXXXXXXX/). ## Solo Flavor Changes - **Added** a `--revision` (`-r`) flag to `istioctl bootstrap`, allowing users to target a specific control plane revision. When set, the command looks up `istiod-{revision}` instead of the default `istiod` service. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.7 Tue, 19 May 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.7 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.6 and 1.28.7. ## General Changes - Built against upstream [Istio commit `8841aa2300644a6f2086a0d20b1ec1699387d4db`](https://github.com/istio/istio/commits/8841aa2300644a6f2086a0d20b1ec1699387d4db/). [Compare](https://github.com/istio/istio/compare/fedc125797618f270984cb4b311268b4e6faefc9..8841aa2300644a6f2086a0d20b1ec1699387d4db). ## Solo Flavor Changes - **Fixed** an issue where ECS-discovered workloads failed to register as `WorkloadEntry` resources when no domain was specified for an AWS account. A default domain is now used so workloads are always reachable within the mesh. - **Fixed** an issue where the ECS controller did not respect custom system namespace configurations. The controller now uses the configured namespace instead of defaulting to `istio-system`. - **Fixed** an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected. - **Fixed** traffic routing failures for global services that use named `targetPort` values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports. - **Fixed** cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.8 Fri, 05 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.8 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.7 and 1.28.8. ## Security Notice ### Envoy CVEs - __[CVE-2026-47774](https://nvd.nist.gov/vuln/detail/CVE-2026-47774)__ / __[GHSA-22m2-hvr2-xqc8](https://github.com/istio/istio/security/advisories/GHSA-22m2-hvr2-xqc8)__: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service. ## General Changes - Built against upstream Istio version 1.28.8, release note can be found [here](https://istio.io/latest/news/releases/1.28.x/announcing-1.28.8). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to detect missing local `Segment` resources that cause auto-generated `ServiceEntry` resources from a peered cluster to be silently dropped. The check now reports rejected peer `Segment` resources with an actionable message explaining how to resolve the misconfiguration. - **Improved** `istioctl multicluster check` to support structured output via a new `--output` (`-o`) flag. Passing `-o json` or `-o yaml` emits all check results as a structured document grouped by cluster. - **Improved** `istioctl multicluster check` to also detect rejected peer `Segment` states caused by hostname mismatches and overlapping `Segment` domains. - **Added** a service account consistency check to `istioctl multicluster check` that reports when a remote gateway's effective service account differs from the corresponding peer east-west gateway. - **Fixed** duplicate target port mappings that caused `ServiceEntry` validation failures. - **Fixed** an issue where `ServiceEntry` resources were not removed after their associated `Service` was removed. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.28.9 Wed, 24 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.28.9 patch release.

This release note describes what's different between Solo builds of Istio versions 1.28.8 and 1.28.9. ## Security Notice ### Envoy CVEs This release includes the following security fixes (see [ISTIO-SECURITY-2026-005](https://istio.io/latest/news/security/istio-security-2026-005/)): - __[GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch)__: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition. - __[CVE-2026-47204](https://nvd.nist.gov/vuln/detail/CVE-2026-47204)__: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route. - __[CVE-2026-47205](https://nvd.nist.gov/vuln/detail/CVE-2026-47205)__: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check. - __[CVE-2026-47207](https://nvd.nist.gov/vuln/detail/CVE-2026-47207)__: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy. - __[CVE-2026-47221](https://nvd.nist.gov/vuln/detail/CVE-2026-47221)__: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault. - __[CVE-2026-47692](https://nvd.nist.gov/vuln/detail/CVE-2026-47692)__: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host. - __[CVE-2026-47775](https://nvd.nist.gov/vuln/detail/CVE-2026-47775)__: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter's AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a `gcm.` algorithm marker, which authenticates the ciphertext and removes the oracle. - __[CVE-2026-47778](https://nvd.nist.gov/vuln/detail/CVE-2026-47778)__: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions. - __[CVE-2026-48042](https://nvd.nist.gov/vuln/detail/CVE-2026-48042)__: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the `envoy.reloadable_features.limit_json_parser_nesting_depth` to `false`. - __[CVE-2026-48044](https://nvd.nist.gov/vuln/detail/CVE-2026-48044)__: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the `MaxInflateRatio` limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single `process()` call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached. - __[CVE-2026-48090](https://nvd.nist.gov/vuln/detail/CVE-2026-48090)__: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (`onDestroy()` had been called), which could lead to accessing dangling pointers and result in UAF/crash. - __[CVE-2026-48497](https://nvd.nist.gov/vuln/detail/CVE-2026-48497)__: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use `ENVOY_BUG` in case the sanity check fails. - __[CVE-2026-48706](https://nvd.nist.gov/vuln/detail/CVE-2026-48706)__: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name. - __[CVE-2026-48743](https://nvd.nist.gov/vuln/detail/CVE-2026-48743)__: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard `envoy.reloadable_features.quic_validate_headers_only_content_length`. ## General Changes - Built against upstream [Istio commit `178a15c6a13651a3b970f0bd4b7534439f0a2678`](https://github.com/istio/istio/commits/178a15c6a13651a3b970f0bd4b7534439f0a2678/). [Compare](https://github.com/istio/istio/compare/8938c4386c0d6b802e4320f839f49f02bbf7ec61..178a15c6a13651a3b970f0bd4b7534439f0a2678). ## Solo Flavor Changes - **Fixed** sidecar waypoint interop to reduce control plane memory consumption. - **Fixed** the documentation link in `istioctl multicluster check --help` to point to `docs.solo.io/istio/` instead of the outdated `docs.solo.io/gloo-mesh/` path. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.0 Tue, 24 Feb 2026 00:00:00 GMT Minor Release
Solo build of Istio version 1.29.0 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.28.0 and 1.29.0. ## Upgrade Notes ### Manual configuration of ECS platform discovery If you install Istio using Helm, Gloo Operator, or istioctl, no action is required. If you manually configure ECS platform discovery by setting the `ECS_ACCOUNTS` environment variable, you will need to add an array of regions for each account. For example: ```shell # old ECS_ACCOUNTS="example.acme,arn:aws:iam::1111111111:role/istiod" # new ECS_ACCOUNTS="example.acme,arn:aws:iam::1111111111:role/istiod,[us-east-1 us-east-2]" ``` If you wish to continue using the default region of the associated AWS role, simply use the empty array `[]`. For example: ```shell ECS_ACCOUNTS="example1.acme,arn:aws:iam::1111111111:role/istiod,[]" ``` ## General Changes - Built against upstream [Istio commit `704e74ee3d20aca29cf4826d3fd5d8e516c59b20`](https://github.com/istio/istio/commits/704e74ee3d20aca29cf4826d3fd5d8e516c59b20/). - **Updated** requirements for using FIPS and LTS flavors of Istio. Using either of these will now require a valid license. ## Solo Flavor Changes - **Added** `aliases` to the `Segment` custom resource, enabling a high degree of customization of hostnames for global services. Aliases allow peered multi-cluster services to be addressed by user-defined names, providing flexibility in how services are discovered and routed across clusters. - **Improved** the `istioctl multicluster check` command with the following enhancements: - Show gateway addresses, peer cluster addresses, and globally shared services - Skip the stale workload check unless flat-network is detected - Network configuration validation - Validation for the compatibility of intermediate certificates between peered clusters - Enhanced validation checks for flat-network configurations - **Added** several enhancements to `istioctl ztunnel-config`: - New `endpoints` subcommand (aliases: `ep`, `endpoint`) to retrieve endpoint information for a specific service, accepting `--service`, `--hostname`, and `--service-namespace` flags with table, JSON, and YAML output - `NETWORK` and `NETWORK GATEWAY` columns to the `workloads` subcommand output for better visibility into workload network configuration - Support to retrieve connections from an east-west gateway via the `connections` subcommand - **Added** new CLI options to the `istioctl multicluster expose` and `link` commands: - `--data-plane-service-type` on `expose`: specifies a comma-delimited list of data plane service types peers can use (`loadbalancer` or `nodeport`, default `loadbalancer`) - `--preferred-data-plane-service-type` on `link`: specifies the preferred data plane service type when peering with a remote cluster (`loadbalancer` or `nodeport`, default `loadbalancer`) - `--generate` on `link`: generates Gateway manifests for multiple contexts at once - **Added** ambient and ztunnel enhancements: - Ztunnel Helm support for `dnsPolicy` and `dnsConfig` customization - A mesh-wide escape hatch based on port matching for outbound traffic impacted by ztunnel capture, configured via `AMBIENT_EXCLUDE_OUTBOUND_PORTS` environment variable (e.g., `AMBIENT_EXCLUDE_OUTBOUND_PORTS="1443,16000-16010"`) - Native nftables support for the port exclusion escape hatch (`AMBIENT_EXCLUDE_OUTBOUND_PORTS` now works with both iptables and nftables backends) - **Added** several east-west gateway improvements: - Support for breaking connections to pods that are terminated - `PodDisruptionBudget` and `HorizontalPodAutoscaler` resources to the kube-eastwest gateway template, customizable via the gateway class `ConfigMap` - **Added** a new peering Helm chart for managing istio-eastwest and istio-remote gateways. This chart provides an alternative to using `istioctl multicluster expose` and `istioctl multicluster link` commands, supporting declarative management of east-west and remote peering gateways via Helm. - **Added** peering metrics to monitor the health and performance of peer cluster connections: - `peer_connection_state`: Gauge metric tracking the connection state of peer clusters (1 = connected, 0 = disconnected), labeled by `peer` and `source` cluster. - `peer_xds_config_size_bytes`: Distribution metric tracking the size of XDS configuration received from peer clusters, labeled by `peer`, `source`, and `type`. - `peer_convergence_time`: Distribution metric tracking the time from sending an XDS request to a peer until receiving a response, labeled by `peer`, `source`, `type`, and `success`. - **Added** the `solo.io/prefer-other` `ServiceEntry` annotation to enable preference-based `ServiceEntry` conflict resolution across namespaces. When multiple `ServiceEntry` resources define the same hostname, this annotation indicates that Istio should prefer any `ServiceEntry` without the annotation, regardless of namespace. This allows for better behavior in migration scenarios where legacy `ServiceEntry` resources can be marked as fallbacks while new `ServiceEntry` resources take priority. - **Added** namespace-level traffic distribution annotation. Services inherit traffic distribution from namespace annotation when not explicitly set on the service. - **Added** multi-region support to ECS platform discovery. Previously only ECS resources within the default region of the configured AWS role would be discovered. - **Added** the ability to specify authorized namespaces for debug endpoints when `ENABLE_DEBUG_ENDPOINT_AUTH=true`. Enable by setting `DEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES` to a comma-separated list of authorized namespaces. The system namespace (typically `istio-system`) is always authorized. - **Added** support to retry failed remote peer creation or updates when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled. - **Removed** the explicit requirement for specifying an HBONE listener on an istio-remote gateway resource. If an istio-remote gateway's preferred data plane service type is `loadbalancer`, a network gateway is created with the well-known HBONE port value 15008. Backwards compatibility is maintained by still allowing an HBONE listener to be specified. - **Improved** `istioctl` command help, refreshing CLI descriptions and examples with clearer guidance for `bootstrap`, `ecs service-add`, and `multicluster`'s `check`, `expose`, and `link` commands. - **Fixed** multiple NodePort peering issues: - `ServiceInfo` events not propagated after the `HboneNodePort` field changed, which broke NodePort peering when a gateway was annotated after its initial creation - Nodes in a `NotReady` state still being used for multi-cluster traffic routing - Node IP address type selection now only considers internal IP addresses - A comma-delimited value for the `peering.solo.io/data-plane-service-type` annotation preventing node workloads from being sent to peers - Simultaneous processing of node `WorkloadEntry` and gateway-derived `ServiceEntry` delete events causing the node `WorkloadEntry` to persist - Generated `ServiceEntry` and node `WorkloadEntry` not being cleaned up when the istio-remote gateway's `peering.solo.io/preferred-data-plane-service-type` annotation was no longer set to `NodePort` - Node `WorkloadEntry` resources failing to be created when NodePort peering was enabled after the peer initially connected via LoadBalancer for an extended period of time - **Fixed** several waypoint interop issues: - Traffic skipping local waypoints when there were no healthy endpoints (traffic will now fail) - An istiod crash when attempting to use Waypoint interop with sidecar and gateway proxies - Ingress gateways applying the waypoint's `DestinationRule` instead of the service's own `DestinationRule` regardless of whether the `istio.io/ingress-use-waypoint` label was set - `ingress-use-waypoint` label propagation from namespace to federated service - **Fixed** various `istioctl` command issues: - The `bootstrap` and `ecs add-service` commands now respect the `-i` istio system namespace flag - The `ecs add-service` command no longer incorrectly reports that a task definition does not have an `executionRoleArn` defined - **Fixed** flat-network multi-cluster peering issues: - User `WorkloadEntry`-based endpoints not being properly peered across clusters, preventing VMs and external workloads from being reachable from proxies in different clusters - Traffic being sent to pods peered for flat-network multi-cluster which are `Not Ready` or `Terminating` - **Fixed** an issue where services with takeover enabled (`solo.io/service-takeover=true` or `solo.io/service-scope=global-only`) did not default their traffic distribution to `PreferNetwork`. This makes takeover service traffic distribution consistent with federated service behavior. - **Fixed** east-west gateway TLS listeners showing an incorrect "UnsupportedProtocol" status when `PILOT_ENABLE_ALPHA_GATEWAY_API` was disabled. - **Fixed** an issue with upgrading from 1.27 that created `WorkloadEntry` resources for Pods in remote clusters that are not reachable on the same network. - **Fixed** an issue causing Envoy clusters for peered global services to not have the `tlsMode-istio` transport socket configured. - **Fixed** an issue where istiod would generate invalid `WorkloadEntry` when remote services have unnamed ports. - **Fixed** an issue where istiod would refuse to peer with clusters when the remote cluster tries to declare a Segment's domain as one that overlaps with another Segment's domain. - **Fixed** an issue where status on `Segment` resources was not updating. - **Fixed** an issue where the remote peer did not have its address updated when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled. - **Fixed** an issue where updating the address in the istio-remote Gateway resource would not prompt the control plane to connect to the new address. - **Fixed** an issue that occurred when draining was enabled and no cluster name was found. A warning is now issued. - **Fixed** an issue where deleting an active ECS `ServiceEntry` or `WorkloadEntry` caused it to be recreated. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.1-patch0 Fri, 03 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.1-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.1 and 1.29.1-patch0. ## Security Notice - **Envoy Transformation Filter CONNECT Request Crash**: (Severity: High): A vulnerability exists in Solo's transformation filter. When a route or virtual host is configured with a transformation rule that includes a path-based request matcher, an unauthenticated attacker can send an HTTP CONNECT request, causing Envoy to crash. This is a potential Denial of Service (DoS) attack vector. The crash can be triggered only if you have a transformation with a path matcher defined. This is only possible with an `EnvoyFilter` with a transformation that includes a path matcher: ```yaml patch: operation: MERGE value: typed_per_filter_config: io.solo.transformation: "@type": "type.googleapis.com/transformation.options.gloo.solo.io.TransformationPerRoute" staged_transformations: regular: request_transforms: - matcher: prefix: '/' request_transformation: {} ``` ## General Changes - Built against upstream [Istio commit `41fcbb218b64108c3410133f0dda80c5ee77afc2`](https://github.com/istio/istio/commits/41fcbb218b64108c3410133f0dda80c5ee77afc2/). [Compare](https://github.com/istio/istio/compare/6991a379e1fcfbe21e64da2eda5d56624a5547b4..41fcbb218b64108c3410133f0dda80c5ee77afc2). ## Solo Flavor Changes - **Added** a new environment variable `PEERING_EXCLUDED_METADATA` that defines a comma-delimited string of labels and annotations which are excluded from auto-generated peering resources' metadata. - **Added** the ability to propagate labels from source Kubernetes resources to their peered `WorkloadEntry` counterparts. - The pilot-specific `ENABLE_PEERING_LABEL_PROPAGATION` environment variable value accepts: - a comma-delimited string of label keys that should be propagated if they exist - the 'all' keyword to propagate all labels - Global Services can have their labels propagated - In a flat-networking scenario, `Pods` can have their labels propagated - **Added** the `PILOT_PEERING_WE_EXCLUSION_LABELS` environment variable to prevent peering-generated `ServiceEntries` from selecting `WorkloadEntries` that carry specified label keys. Accepts a comma-separated list of label keys. Any `WorkloadEntry` carrying at least one of these keys will not be selected by a peering-generated `ServiceEntry`. Non-peering `ServiceEntries` are unaffected. Defaults to `gloo.solo.io/parent_name`, which excludes GME VirtualDestination-generated `WorkloadEntries` from peering `ServiceEntry` selection. - **Added** a `gloo.solo.io/NodePortConfigured` status condition on `istio-eastwest` gateways configured for NodePort peering. When the gateway's managed service has no port with `hbone` in its name, the condition is set to `False` with reason `MissingHbonePort` and a descriptive message. When a valid `hbone` port is present, the condition is `True` with reason `Programmed`. - **Added** support for running `istioctl multicluster check` against extracted bug-report directories, enabling offline multicluster analysis without direct cluster access. - **Fixed** an issue where adding the draining annotation to the East-West `Gateway` caused a restart. **Fixed** an issue where adding the traffic distribution annotation to a `Gateway` (waypoint) caused a restart. - **Fixed** a bug in multicluster ambient sidecar interoperability setups where multiple `ServiceEntries` fronting the same `Pod` could cause the sidecar to get incorrect listener configuration and thus cause all multicluster traffic to fail. - **Fixed** a bug where DNS responses for a hostname served by both a `prefer-other` `ServiceEntry` and a non-prefer-other `ServiceEntry` could include addresses from both, causing DNS flip-flopping. - **Fixed** an issue where adding a service-type annotation to the East-West `Gateway` caused a restart. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.1 Wed, 11 Mar 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.1 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.29.0 and 1.29.1. ## Security Notice This release contains fixes to a number of CVEs. ### Envoy CVEs - __[CVE-2026-26308](https://nvd.nist.gov/vuln/detail/CVE-2026-26308)__: (CVSS score 7.5, High): Fixed RBAC header matcher to validate each header value individually instead of concatenating multiple header values into a single string. This prevents potential bypasses when requests contain multiple values for the same header. - __[CVE-2026-26311](https://nvd.nist.gov/vuln/detail/CVE-2026-26311)__: (CVSS score 5.9, Medium): Fixed an issue where filter chain execution could continue on HTTP streams that had been reset but not yet destroyed, potentially causing use-after-free conditions. - __[CVE-2026-26310](https://nvd.nist.gov/vuln/detail/CVE-2026-26310)__: (CVSS score 5.9, Medium): Fixed a crash in `Utility::getAddressWithPort` when called with a scoped IPv6 address (e.g., `fe80::1%eth0`). - __[CVE-2026-26309](https://nvd.nist.gov/vuln/detail/CVE-2026-26309)__: (CVSS score 5.3, Medium): Fixed an off-by-one write in `JsonEscaper::escapeString()` that could corrupt the string null terminator. - __[CVE-2026-26330](https://nvd.nist.gov/vuln/detail/CVE-2026-26330)__: (CVSS score 5.3, Medium): Fixed a bug in the gRPC rate limit client that could lead to potential use-after-free issues. Only affects Istio 1.28 and 1.29. ### Istio CVEs - __[CVE-2026-31838](https://nvd.nist.gov/vuln/detail/CVE-2026-31838)__ / __[GHSA-974c-2wxh-g4ww](https://github.com/istio/istio/security/advisories/GHSA-974c-2wxh-g4ww)__: (CVSS score 6.9, Medium): Debug Endpoints Allow Cross-Namespace Proxy Data Access. - __[CVE-2026-31837](https://nvd.nist.gov/vuln/detail/CVE-2026-31837)__ / __[GHSA-v75c-crr9-733c](https://github.com/istio/istio/security/advisories/GHSA-v75c-crr9-733c)__: (CVSS score 8.7, High): JWKS Resolver Failure May Allow Authentication Bypass Using Known Default Keys. ### Other Istio Security Fixes - **Fixed** XDS debug endpoints on plaintext port 15010 to require authentication, preventing unauthenticated access to proxy configuration. - **Fixed** potential SSRF in `WasmPlugin` image fetching by validating bearer token realm URLs. - **Fixed** HTTP debug endpoints on port 15014 to enforce namespace-based authorization, preventing cross-namespace proxy data access. ## General Changes - Built against upstream [Istio commit `e033c7a0e1575d4732cb2353af7928a052bbfcb3`](https://github.com/istio/istio/commits/e033c7a0e1575d4732cb2353af7928a052bbfcb3/). [Compare](https://github.com/istio/istio/compare/704e74ee3d20aca29cf4826d3fd5d8e516c59b20..e033c7a0e1575d4732cb2353af7928a052bbfcb3). ## Solo Flavor Changes - **Added** metrics to track mesh config parsing and validation status. New `pilot_meshconfig_validation_status` and `pilot_meshnetworks_validation_status` gauges indicate whether the current mesh configuration is valid (0) or invalid (1). - **Added** support for loading license keys from mounted volumes. The path where the volume is mounted should be provided as the `license.volume` Helm value. - **Added** a check to `istioctl multicluster check validation` to ensure all Istio proxy containers and all `sidecar-injector` `ConfigMap` templates have the `ISTIO_META_NETWORK` environment variable set to match the network label on the `istio-system` namespace. - **Added** check to `istioctl multicluster check` to verify `ambient.dnsCapture` is enabled in `istio-cni-config` `ConfigMap`. - **Added** check to `istioctl multicluster check` to verify `topology.istio.io/cluster` label is present and valid on istio-remote gateways. - **Fixed** the `istioctl multicluster check` pod check to dynamically discover eastwest gateway names from `Gateway` objects instead of hardcoding `istio-eastwest`. - **Fixed** a bug where traffic could be non-deterministically routed through a `prefer-other` `ServiceEntry` instead of a non-`prefer-other` `ServiceEntry` with the same hostname. This could occur when a `VirtualService` referenced a hostname served by both types of `ServiceEntry` and there was an explicit sidecar scope that limited the visibility of the non-`prefer-other` `ServiceEntry`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.2-patch0 Mon, 20 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.2-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.2 and 1.29.2-patch0. ## General Changes - Built against upstream [Istio commit `7ffa1cb335d26be81b765b92f241956266099457`](https://github.com/istio/istio/commits/7ffa1cb335d26be81b765b92f241956266099457/). [Compare](https://github.com/istio/istio/compare/0c774325b938c4dbda4ea4ad4fb6156e80a12de8..7ffa1cb335d26be81b765b92f241956266099457). ## Solo Flavor Changes - **Fixed** traffic routing failures for global services that use named `targetPort` values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports. - **Fixed** sidecar generation with service takeover enabled and no local service. - **Fixed** an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected. - **Fixed** an issue where the ECS controller did not respect custom system namespace configurations, now properly using the configured namespace instead of defaulting to `istio-system`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.2 Wed, 15 Apr 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.2 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.1-patch0 and 1.29.2. ## Security Notice This release bumps the Go version to 1.25.9, which includes fixes for the following security vulnerabilities in the Go `crypto` packages: - **[CVE-2026-32280](https://github.com/golang/go/issues/78282)** (CVSS 7.5, High) (`crypto/x509`): During chain building, the amount of work performed is not correctly limited when a large number of intermediate certificates are passed in `VerifyOptions.Intermediates`, which can lead to a denial of service. This affects both direct users of `crypto/x509` and users of `crypto/tls`. - **[CVE-2026-32281](https://github.com/golang/go/issues/78281)** (Unscored, Undergoing Analysis) (`crypto/x509`): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains. - **[CVE-2026-32283](https://github.com/golang/go/issues/78334)** (Unscored, Undergoing Analysis) (`crypto/tls`): If one side of a TLS 1.3 connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. - **[CVE-2026-33810](https://github.com/golang/go/issues/78332)** (Unscored, Undergoing Analysis) (`crypto/x509`): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs that use a different case than the constraint. For example, if a certificate contains the DNS name `*.example.com` and the excluded DNS name `EXAMPLE.COM`, the constraint will not be applied. This only affects validation of otherwise trusted certificate chains. ## General Changes - Built against upstream Istio version 1.29.2, release note can be found [here](https://istio.io/latest/news/releases/1.29.x/announcing-1.29.2). - Built against upstream Istio commit `COMMIT`. See the commit and history [here](https://github.com/istio/istio/commits/XXXXXXXXXXXXX/). ## Solo Flavor Changes - **Added** a `--revision` (`-r`) flag to `istioctl bootstrap`, allowing users to target a specific control plane revision. When set, the command looks up `istiod-{revision}` instead of the default `istiod` service. - **Fixed** an issue where the ECS controller did not respect custom system namespace configurations, now properly using the configured namespace instead of defaulting to `istio-system`. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.3 Mon, 18 May 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.3 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.29.2 and 1.29.3. ## General Changes - Built against upstream [Istio commit `dfb1391407244d2642141cd24acad672a48e8e3e`](https://github.com/istio/istio/commits/dfb1391407244d2642141cd24acad672a48e8e3e/). [Compare](https://github.com/istio/istio/compare/5c9e58b03ec3dd5ae1c87dba463d7388e0792fb8..dfb1391407244d2642141cd24acad672a48e8e3e). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to detect missing local `Segment` resources that cause auto-generated `ServiceEntry` resources from a peered cluster to be silently dropped. The check now reports rejected peer `Segment` resources with an actionable message explaining how to resolve the misconfiguration. - **Improved** `istioctl multicluster check` to also detect rejected peer `Segment` states caused by hostname mismatches and overlapping `Segment` domains. - **Added** a service alias conflicts check to `istioctl multicluster check` that reports hostname conflicts by reading the controller's conflict annotations on auto-generated `ServiceEntry` resources. - **Fixed** an issue where ECS services with long cluster or service names could not join the mesh due to the `ecs.solo.io/hostname` label value exceeding the 63-character Kubernetes limit. - **Fixed** an issue where ECS-discovered workloads failed to register as `WorkloadEntry` resources when no domain was specified for an AWS account. A default domain is now used so workloads are always reachable within the mesh. - **Fixed** an issue where the global waypoint label value could exceed the Kubernetes 63-byte limit when the waypoint name, namespace, and domain were long, causing the label to be rejected. - **Fixed** traffic routing failures for global services that use named `targetPort` values. Requests could be sent to the wrong port when routing across clusters or to local services exposed via named ports. - **Fixed** `Sidecar` generation with service takeover enabled and no local service. - **Fixed** an issue where updating a remote cluster's `Segment` CRD `domain` or `aliases` fields would not regenerate peered `ServiceEntry` hostnames. - **Fixed** cross-network traffic through a waypoint when a service that uses that waypoint is configured with a route that redirects to another service that does not use that waypoint. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.4-patch0 Wed, 10 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.4-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.4 and 1.29.4-patch0. ## General Changes - Built against upstream [Istio commit `d5e1b4391d937ec682eac3d24ea9f203ef7bbdc3`](https://github.com/istio/istio/commits/d5e1b4391d937ec682eac3d24ea9f203ef7bbdc3/). [Compare](https://github.com/istio/istio/compare/1ca3807265430071cc842366ff51f275e18297a6..d5e1b4391d937ec682eac3d24ea9f203ef7bbdc3). - **Fixed** an issue where ambient-enrolled pods could be dropped from the host `istio-inpod-probes-v4` `ipset` after a node or `kubelet` restart, causing `kubelet` health probes to be rejected by ztunnel until `istio-cni` restarted. The node agent now re-asserts probe `ipset` membership for enrolled pods during reconciliation. ## Solo Flavor Changes - **Fixed** the extra long shutdown window (60s). It is now much faster (~5s). - **Fixed** the documentation link in `istioctl multicluster check --help` to point to `docs.solo.io/istio/` instead of the outdated `docs.solo.io/gloo-mesh/` path. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.4-patch1 Fri, 12 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.4-patch1 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.4-patch0 and 1.29.4-patch1. ## General Changes - Built against upstream [Istio commit `f6351e6c76fa1271f74a2eec053a2210e1ab835f`](https://github.com/istio/istio/commits/f6351e6c76fa1271f74a2eec053a2210e1ab835f/). [Compare](https://github.com/istio/istio/compare/d5e1b4391d937ec682eac3d24ea9f203ef7bbdc3..f6351e6c76fa1271f74a2eec053a2210e1ab835f). ## Solo Flavor Changes - **Improved** memory usage by converting remaining `envoy.string` filter metadata to `istio.hashable_string` on proxies version 1.29.2 and higher. ## FIPS Flavor Changes - **Fixed** a regression on `Bottlerocket` and `AlmaLinux` where the `install-cni` wrapper `shebang` rewrite produced an invalid host path, causing pod creation to fail with `istio-cni-bin: No such file or directory`. `install-cni` now accepts an optional `NODE_CNI_BIN_DIR` environment variable that overrides the auto-detected path. `Bottlerocket` and `AlmaLinux` users should set it to `/opt/cni/bin` and restart the `DaemonSet`: ``` helm upgrade istio-cni ... --set "env.NODE_CNI_BIN_DIR=/opt/cni/bin" kubectl rollout restart ds/istio-cni-node -n istio-system ``` ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.4 Fri, 05 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.4 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.3 and 1.29.4. ## Security Notice ### Envoy CVEs - __[CVE-2026-47774](https://nvd.nist.gov/vuln/detail/CVE-2026-47774)__ / __[GHSA-22m2-hvr2-xqc8](https://github.com/istio/istio/security/advisories/GHSA-22m2-hvr2-xqc8)__: (CVSS score 7.5, High): Fixed an HTTP/2 memory exhaustion issue where cookie header bytes were not fully accounted for during request header size validation, allowing specially crafted requests with large cookie headers to trigger excessive memory consumption and cause a denial of service. ## General Changes - Built against upstream Istio version 1.29.4, release note can be found [here](https://istio.io/latest/news/releases/1.29.x/announcing-1.29.4). ## Solo Flavor Changes - **Improved** `istioctl multicluster check` to support structured output via a new `--output` (`-o`) flag. Passing `-o json` or `-o yaml` emits all check results as a structured document grouped by cluster. - **Added** a service account consistency check to `istioctl multicluster check` that reports when a remote gateway's effective service account differs from the corresponding peer east-west gateway. - **Fixed** duplicate target port mappings that caused `ServiceEntry` validation failures. - **Fixed** an issue where `ServiceEntry` resources were not removed after their associated `Service` was removed. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.5 Wed, 24 Jun 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.5 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.4-patch1 and 1.29.5. ## Security Notice ### Envoy CVEs This release includes the following security fixes (see [ISTIO-SECURITY-2026-005](https://istio.io/latest/news/security/istio-security-2026-005/)): - __[GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch)__: (CVSS score 7.5): Fixed a denial-of-service vulnerability in the HTTP/3 stack via QPACK blocked decoding. When a QPACK header block was blocked waiting for dynamic table updates, the HEADERS payload bytes were released from QUIC receive-flow-control accounting while still retained in an internal decoder heap buffer, allowing a remote attacker to drive unbounded memory growth and trigger an out-of-memory condition. - __[CVE-2026-47204](https://nvd.nist.gov/vuln/detail/CVE-2026-47204)__: (CVSS score 6.5): Fixed a crash or use-after-free when gRPC stats filter performs stat tracking on a direct response route. - __[CVE-2026-47205](https://nvd.nist.gov/vuln/detail/CVE-2026-47205)__: (CVSS score 5.9): Fixed a use-after-free crash in the ext_authz filter when per-route service overrides are active and the downstream connection resets during an in-flight authorization check. - __[CVE-2026-47207](https://nvd.nist.gov/vuln/detail/CVE-2026-47207)__: (CVSS score 6.5): Fixed a bug when the ext_proc server sends packed unexpected ProcessingResponses to Envoy. - __[CVE-2026-47220](https://nvd.nist.gov/vuln/detail/CVE-2026-47220)__: (CVSS score 7.5): Fixed a crash bug in the `%REQUESTED_SERVER_NAME%` formatter where the host or original host is not set correctly but the formatter is configured to access the host value. - __[CVE-2026-47221](https://nvd.nist.gov/vuln/detail/CVE-2026-47221)__: (CVSS score 5.9): Fixed an issue when handling HTTP 303 internal redirects for body-less requests. The redirect handling code attempted to drain a request body buffer that was never allocated, causing a segmentation fault. - __[CVE-2026-47692](https://nvd.nist.gov/vuln/detail/CVE-2026-47692)__: (CVSS score 4.8): Fixed a bug where passthrough TLVs combined with added TLVs could exceed the maximum length, resulting in a mismatch between the size reported in the header and the number of bytes written. This could allow a smuggled request from the host writing the PROXY protocol header to the upstream host. - __[CVE-2026-47775](https://nvd.nist.gov/vuln/detail/CVE-2026-47775)__: (CVSS score 6.8): Addressed a padding oracle in the OAuth2 filter's AES-256-CBC cookie decryption. The filter now supports AES-256-GCM encryption with a `gcm.` algorithm marker, which authenticates the ciphertext and removes the oracle. - __[CVE-2026-47778](https://nvd.nist.gov/vuln/detail/CVE-2026-47778)__: (CVSS score 4.4): Fixed an issue where Envoy could fail to validate the Subject Alternative Name (SAN) of a peer certificate if the SAN contained an embedded NUL byte. Previously, the SAN parsing was vulnerable to NUL byte truncation in some configurations, potentially leading to incorrect trust decisions. - __[CVE-2026-48042](https://nvd.nist.gov/vuln/detail/CVE-2026-48042)__: (CVSS score 7.5): Limited JSON nesting depth to 1000. The limit could be relaxed to 10K by setting the `envoy.reloadable_features.limit_json_parser_nesting_depth` to `false`. - __[CVE-2026-48044](https://nvd.nist.gov/vuln/detail/CVE-2026-48044)__: (CVSS score 7.5): Fixed a memory exhaustion vulnerability in the Zstd decompressor where the `MaxInflateRatio` limit was only checked after each input slice was fully processed, allowing a maliciously crafted compressed payload to expand to hundreds of MB within a single `process()` call. The inflate ratio limit is now enforced inside the inner decompression loop, matching the gzip and brotli decompressors and aborting decompression as soon as the threshold is breached. - __[CVE-2026-48090](https://nvd.nist.gov/vuln/detail/CVE-2026-48090)__: (CVSS score 5.9): Fixed a bug where the asynchronous token change callback could be triggered after the filter had been torn down (`onDestroy()` had been called), which could lead to accessing dangling pointers and result in UAF/crash. - __[CVE-2026-48497](https://nvd.nist.gov/vuln/detail/CVE-2026-48497)__: (CVSS score 5.9): Fixed sanity checking of the query name length to avoid abnormal process termination. Use `ENVOY_BUG` in case the sanity check fails. - __[CVE-2026-48706](https://nvd.nist.gov/vuln/detail/CVE-2026-48706)__: (CVSS score 5.9): Fixed a TcpStatsdSync buffer overflow issue with a large stats name. - __[CVE-2026-48743](https://nvd.nist.gov/vuln/detail/CVE-2026-48743)__: (CVSS score 7.5): Fixed HTTP/3 headers-only request and response content-length validation and reset stream if inconsistent. The change is guarded by runtime guard `envoy.reloadable_features.quic_validate_headers_only_content_length`. ## General Changes - Built against upstream [Istio commit `a64c4cf737704d3ac7a4d883207fca2b7e1ba9bd`](https://github.com/istio/istio/commits/a64c4cf737704d3ac7a4d883207fca2b7e1ba9bd/). [Compare](https://github.com/istio/istio/compare/f6351e6c76fa1271f74a2eec053a2210e1ab835f..a64c4cf737704d3ac7a4d883207fca2b7e1ba9bd). ## Solo Flavor Changes - **Fixed** sidecar waypoint interop to reduce control plane memory consumption. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.6 Fri, 17 Jul 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.6 patch release.

This release note describes what’s different between Solo builds of Istio versions 1.29.5 and 1.29.6. ## General Changes - Built against upstream [Istio commit `074c0a5d278fdcd4d338977a9f90bd58a9ead176`](https://github.com/istio/istio/commits/074c0a5d278fdcd4d338977a9f90bd58a9ead176/). [Compare](https://github.com/istio/istio/compare/a64c4cf737704d3ac7a4d883207fca2b7e1ba9bd..074c0a5d278fdcd4d338977a9f90bd58a9ead176). ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.7-patch0 Mon, 21 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.7-patch0 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.7 and 1.29.7-patch0. ## Upgrade Notes ### Kubernetes API requests are now bounded by client-side deadlines The defaults suit most clusters. Environments with a slow or heavily loaded API server can raise them, or set any of them to `0` to restore the previous unbounded behavior, with these environment variables on the affected component. | Variable | Default | Applies to | | --- | --- | --- | | `ISTIO_KUBE_HEADER_TIMEOUT` | `90s` | How long any request may wait for its first response headers. Must stay above the API server's `--request-timeout` (60s by default). | | `ISTIO_KUBE_REQUEST_TIMEOUT` | `120s` | Total duration of a normal request, including reading the response. Must exceed `ISTIO_KUBE_HEADER_TIMEOUT`. | | `ISTIO_KUBE_STREAM_TIMEOUT` | `15m` | Total duration of a watch or other stream. Must exceed the API server maximum watch duration. | | `ISTIO_INFORMER_REQUEST_TIMEOUT` | `15m` | Total duration of an informer list. Must accommodate a full list of the largest resource in the cluster. | A canceled request increments `kube_client_deadline_fired_total` and logs a warning naming the method and path. ## General Changes - Built against upstream [Istio commit `879ce47383ebadbaecfff98f2a4b5e85cb2ff5c5`](https://github.com/istio/istio/commits/879ce47383ebadbaecfff98f2a4b5e85cb2ff5c5/). [Compare](https://github.com/istio/istio/compare/2c6c000897cd126005d5a0c9c6c250b8a3b30029..879ce47383ebadbaecfff98f2a4b5e85cb2ff5c5). - **Fixed** `istioctl analyze` building Kubernetes clients directly from `istio-system` multicluster secrets without sanitizing the `kubeconfig`, which could allow a crafted secret to run an `exec` credential plugin (or read local files via other unsafe auth fields) on the machine running `istioctl`. The `kubeconfig` is now sanitized the same way istiod already sanitizes these secrets. **Credit**: This vulnerability was discovered and reported by Adam Korczynski. ## Solo Flavor Changes - **Fixed** Istio components hanging indefinitely when a Kubernetes API request gets no response, for example when a load balancer or proxy silently drops the return path. Previously such a request could stay open forever, stalling the controller that issued it until the process restarted. Requests are now bounded by client-side deadlines, so a stuck request is canceled and the component recovers on its own. Each cancellation is logged as a warning and counted by the `kube_client_deadline_fired_total` metric. - **Fixed** the documentation link in `istioctl multicluster check --help` to point at the documentation for this release rather than `latest`, so the guide it opens matches the version of `istioctl` being run. - **Fixed** the release note for the peering metadata exclusion feature, which named two environment variables that were never added. The feature is controlled by a single environment variable, `PEERING_EXCLUDED_METADATA`. - **Fixed** an issue where the network gateway selected for a workload was picked in a random order when a network had more than one gateway entry, which caused unnecessary workload (WDS) pushes on every recompute and could alternate the gateway address a workload uses. - **Fixed** the peering controller re-validating every peer cluster, and with it every peered workload and service, after each of its own `Segment` status writes, which kept the peering leader busy for a long time after a leader change. - **Fixed** an issue where every peered workload was recomputed each time the peering leader updated the `Segment` status, which caused elevated istiod CPU usage and unnecessary xDS pushes during a peering resync. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.7 Mon, 31 Aug 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.7 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.6 and 1.29.7. ## Security Notice ### Envoy CVEs This release includes the following security fixes (see [ISTIO-SECURITY-2026-006](https://istio.io/latest/news/security/istio-security-2026-006/)): - __[CVE-2026-73513](https://nvd.nist.gov/vuln/detail/CVE-2026-73513)__: (CVSS score 7.5): Fixed a heap use-after-free where an untrusted upstream could send HTTP/2 response trailers without the `END_STREAM` flag to an Envoy instance using `oghttp2`, corrupting stream state and terminating the process. - __[CVE-2026-73552](https://nvd.nist.gov/vuln/detail/CVE-2026-73552)__: (CVSS score 7.5): Fixed an issue where `safe_regex` matching treated accepted non-UTF-8 HTTP header bytes as a non-match; in RBAC policies using negative matching this could fail open and allow access to a protected resource. - __[CVE-2026-73512](https://nvd.nist.gov/vuln/detail/CVE-2026-73512)__: (CVSS score 7.5): Fixed a use-after-free in the QUIC HTTP datagram handler where late HTTP/3 datagrams could reference a stream decoder that was already destroyed or replaced. - __[CVE-2026-73547](https://nvd.nist.gov/vuln/detail/CVE-2026-73547)__: (CVSS score 7.5): Fixed an abnormal process termination in the `ext_authz` filter when processing CONNECT requests without a `:path` pseudo-header. - __[CVE-2026-73549](https://nvd.nist.gov/vuln/detail/CVE-2026-73549)__: (CVSS score 5.3): Fixed an abnormal process termination for scoped IPv6 client addresses in original DST clusters with HTTP/3. - __[CVE-2026-50572](https://nvd.nist.gov/vuln/detail/CVE-2026-50572)__: (CVSS score 5.9): Fixed a use-after-free in the `ext_authz` raw HTTP client where completing an authorization request could destroy the client while its completion handler was still executing. - __[CVE-2026-73546](https://nvd.nist.gov/vuln/detail/CVE-2026-73546)__: (CVSS score 7.4): Fixed a stored cross-site scripting issue in the HTML stats interface (`/stats?format=html`) where dynamically named statistics could introduce attacker-controlled content. - __[CVE-2026-48521](https://nvd.nist.gov/vuln/detail/CVE-2026-48521)__: (CVSS score 5.9): Fixed an abnormal process termination where Envoy could dereference null transport socket options during ALPN-based HTTP/3 connection-pool selection. - __[CVE-2026-73551](https://nvd.nist.gov/vuln/detail/CVE-2026-73551)__: (CVSS score 5.3): Fixed URL normalization of dot and dot-dot path segments containing parameters, which could cause access-control components and upstream applications to interpret a request path differently. - __[CVE-2026-73511](https://nvd.nist.gov/vuln/detail/CVE-2026-73511)__: (CVSS score 5.3): Fixed path matching for paths containing per-segment parameters, where Envoy and backends could select different resources for the same request and bypass path-based selection or authentication. - __[CVE-2026-73548](https://nvd.nist.gov/vuln/detail/CVE-2026-73548)__: (CVSS score 7.5): Fixed cross-user response poisoning involving generic, non-WebSocket HTTP upgrades, where request payload sent before an upgrade was accepted could contaminate a shared upstream connection. - __[CVE-2026-73550](https://nvd.nist.gov/vuln/detail/CVE-2026-73550)__: (CVSS score 7.5): Fixed an HTTP/2 memory-exhaustion issue where discarded duplicate Host headers were not counted toward request-header size and count limits. - __[CVE-2026-73553](https://nvd.nist.gov/vuln/detail/CVE-2026-73553)__: (CVSS score 7.5): Fixed an authorization bypass when `ignore_path_parameters_in_path_matching` was enabled, where a path such as `/admin;x` could bypass an RBAC policy for `/admin` while still reaching the protected route. ### Istio CVEs - __[GHSA-qm8v-g4f9-qhjx](https://github.com/istio/istio/security/advisories/GHSA-qm8v-g4f9-qhjx)__: (CVSS score 6.8): Fixed `BackendTLSPolicy` failing open on sidecar proxies. When the policy's `caCertificateRefs` could not be resolved, the sidecar dropped the upstream TLS transport socket and sent the traffic in plaintext instead of blocking it, losing the encryption and CA validation the policy required. Gateway proxies were not affected. ### Istio security fixes - **Fixed** a control plane denial of service via the `EnvoyFilter` `proxyVersion` match expression (`spec.configPatches[].match.proxy.proxyVersion`), which accepted a regular expression of unbounded length. A user able to create `EnvoyFilter` resources in a single namespace could drive excessive memory and CPU usage in istiod. The match expression is now limited to 1024 characters. ## General Changes - Built against upstream [Istio commit `2c6c000897cd126005d5a0c9c6c250b8a3b30029`](https://github.com/istio/istio/commits/2c6c000897cd126005d5a0c9c6c250b8a3b30029/). [Compare](https://github.com/istio/istio/compare/074c0a5d278fdcd4d338977a9f90bd58a9ead176..2c6c000897cd126005d5a0c9c6c250b8a3b30029). ## Solo Flavor Changes - **Added** the `istioctl license` command, which reports the product, state, and expiration of the Solo license in use by each istiod instance. - **Added** opt-in support for `EnterpriseListenerSet` (`enterprise.solo.io/v1alpha1`), a Solo equivalent of the experimental Gateway API `XListenerSet` for platforms that cannot install the `gateway.networking.x-k8s.io` CRD group. Enable with istiod environment variable `SOLO_ENABLE_ENTERPRISE_LISTENER_SET=true` (default `false`). A real `XListenerSet` takes precedence over an `EnterpriseListenerSet` wherever the two collide. Cross-namespace references from an `EnterpriseListenerSet` are authorized by a `ReferenceGrant` naming kind `ListenerSet` in group `gateway.networking.k8s.io`, so grants keep working unchanged when migrating to `ListenerSet` on later Istio releases; a grant naming `EnterpriseListenerSet` is not recognized. An `EnterpriseListenerSet` listener that overlaps another listener on the same parent Gateway — which Istio 1.29 still programs — reports an `enterprise.solo.io/UpgradeConflictWarning` condition. Istio 1.30 or later applies listener merge precedence and will not program the overlapping listener. - **Fixed** generated east-west gateway regeneration when `PEERING_AUTOMATIC_LOCAL_GATEWAY` is enabled and a generated istio-remote gateway is manually modified or deleted. - **Fixed** ztunnel to report the correct egress policies. - **Fixed** ztunnel chart examples for `egressPolicies`. - **Fixed** applying the draining weight from the east-west gateway when no cluster annotation existed. - **Fixed** ReferenceGrant `to` field to handle multiple entries; previously only the last entry was effective, causing incorrect `RefNotPermitted` for references that matched an earlier entry. ## FIPS Flavor Changes No changes in this section. ]]> https://docs.solo.io/istio/1.29.x/reference/changelog/solo-istio/ https://github.com/solo-io/istio/releases/tag/1.29.8 Thu, 24 Sep 2026 00:00:00 GMT Patch Release
Solo build of Istio version 1.29.8 patch release.

This release note describes what's different between Solo builds of Istio versions 1.29.7-patch0 and 1.29.8. ## General Changes - Built against upstream [Istio commit `e507ce0bc3bc9ff0949edfe910ba5e892cd50ffc`](https://github.com/istio/istio/commits/e507ce0bc3bc9ff0949edfe910ba5e892cd50ffc/). [Compare](https://github.com/istio/istio/compare/879ce47383ebadbaecfff98f2a4b5e85cb2ff5c5..e507ce0bc3bc9ff0949edfe910ba5e892cd50ffc). - **Fixed** an `HTTPRoute` rule with several `InferencePool` backendRefs configuring only one endpoint picker. The picker of the last backendRef listed scored every request on the rule, so the other pools' pickers were never invoked, and a pool with no ready endpoints failed the whole rule rather than its own weighted share. Each pool now gets its own picker, attached to its own weighted cluster. - **Fixed** two `HTTPRoute`s sharing a `rules[].name` on the same gateway overwriting each other's endpoint picker. Rule names only have to be unique within one `HTTPRoute`, but the pickers were keyed by name across all of them, so a route could be served by another route's picker. Pickers are now resolved per backendRef, so a shared name no longer moves one route's picker onto another. - **Fixed** a route rule losing its `InferencePool` endpoint picker when it also carried a CORS filter. Both are written into the same per-filter configuration, and the CORS path replaced the map rather than adding to it. ## Solo Flavor Changes No changes in this section. ## FIPS Flavor Changes No changes in this section. ]]>