Cadence & Support Window
Roughly one minor per quarter. A minor is supported until six weeks after the N+2 release, then no more security or critical-bug back-ports.
1.31: released 31 Aug 2026, latest patch 1.31.3
(21 Oct 2026), K8s 1.32–1.37.
1.30: latest patch 1.30.7 (21 Oct 2026), supported
until six weeks after 1.32 (1.32.0-rc.0 on 28 Oct 2026, 1.32.0 not
yet out).
1.29: EOL on 15 Oct 2026, latest
patch 1.29.10 (21 Oct 2026), an exceptional release after EOL for the
second bulletin below.
1.28: EOL since 1 Jul 2026.
Patch to 1.31.3 / 1.30.7: they carry two
bulletins. ISTIO-SECURITY-2026-007 (1.31.2 / 1.30.6), CVSS 9.2 since
26 Oct: Envoy Brotli decompressor overflow (CVE-2026-111497) where
Brotli decompression is enabled, e.g. via EnvoyFilter; also
AuthorizationPolicy DENY rules with
methods and ALLOW rules with
notMethods are bypassed over HTTP/2 by changing the case
of the method. ISTIO-SECURITY-2026-008 (eMudhra intermediate CAs,
CVE-2026-111943): the images no longer trust
emSign ECC Root CA - G3; istiod, istioctl and
pilot-agent (Go 1.26.10) and ztunnel (rustls-webpki 0.103.16) reject
chains with the compromised keys. 1.29.10 has the new CA bundle and
the ztunnel fix but no Go fix. Istio’s own mTLS certificates
are not affected. Affected is what trusts the public CA bundle, e.g.
a DR with tls.mode: SIMPLE and no
caCertificates or credentialName (egress to
external HTTPS), the jwksUri of a RequestAuthentication
(fetched by istiod) or XDS_ROOT_CA=SYSTEM. Until you
upgrade, set caCertificates (or caCrl) on
the DR.
Artifacts from 1.31: images only on
docker.io/istio, charts on blob.istio.io
and ghcr.io/istio/release/charts;
gcr.io/istio-release and registry.istio.io
go dark in Dec 2026 (next scream tests 17 Nov and 8 Dec). 1.31.1+
signed with istio-key-v2.pub. 1.30 defaults to
registry.istio.io/release: set
hub=docker.io/istio (or a mirror) even without
upgrading.
In-place upgrades one minor at a time; canary (revision) upgrades in sidecar mode may skip one (N→N+2); ambient (ztunnel/CNI tolerate only N+1) goes step by step. More than two minors behind means unpatched CVEs.
The status above is that of the PDF (edition 2026.11). Current release and support data with sources are on Releases & EOL, last checked on 30 October 2026.