---
title: "Announcing Istio 1.28.9"
url: https://daily.dev/posts/announcing-istio-1-28-9-jnb76bnms
source_url: https://istio.io/latest/news/releases/1.28.x/announcing-1.28.9
type: article
source: "Istio"
published: 2026-06-24T18:25:42.324Z
updated: 2026-06-24T18:26:08.422Z
tags: ["security", "microservices", "istio", "service-mesh", "envoy"]
reading_time: 3
upvotes: 2
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Announcing Istio 1.28.9

**[Istio](https://daily.dev/sources/istio)** · 3 min read · 2 upvotes · 0 comments

## Summary

Istio 1.28.9 is a patch release focused entirely on security fixes. It addresses 13 Envoy CVEs covering a range of vulnerabilities including: a denial-of-service via HTTP/3 QPACK blocked decoding (CVSS 7.5), a PROXY protocol header smuggling bug (CVSS 4.8), ext_proc filter issues (CVSS 6.5), use-after-free crashes in ext_authz and OAuth2 filters, a memory exhaustion flaw in the Zstd decompressor (CVSS 7.5), SAN validation bypass via NUL byte injection (CVSS 4.4), a gRPC stats filter crash (CVSS 6.5), HTTP/3 content-length validation issues (CVSS 7.5), a padding oracle in OAuth2 AES-256-CBC cookie decryption (CVSS 6.8), and a JSON nesting depth limit to prevent DoS (CVSS 7.5). Users running Istio 1.28.x are advised to upgrade.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://istio.io/latest/news/releases/1.28.x/announcing-1.28.9>

## Similar posts on daily.dev

- [Announcing Istio 1.28.8](https://daily.dev/posts/announcing-istio-1-28-8-epijyju4g) · Istio · 0 upvotes · 0 comments
- [Istio / ISTIO-SECURITY-2026-005](https://daily.dev/posts/istio-istio-security-2026-005-1tnumumha) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.28.5](https://daily.dev/posts/announcing-istio-1-28-5-0qe49rxa7) · Istio · 1 upvotes · 0 comments
- [Announcing Istio 1.29.5](https://daily.dev/posts/announcing-istio-1-29-5-gj4qcmivr) · Istio · 0 upvotes · 0 comments
- [Announcing Istio 1.29.4](https://daily.dev/posts/announcing-istio-1-29-4-nbqrye7ll) · Istio · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#microservices](https://daily.dev/tags/microservices), [#istio](https://daily.dev/tags/istio), [#service-mesh](https://daily.dev/tags/service-mesh), [#envoy](https://daily.dev/tags/envoy)

[View this post on daily.dev](https://daily.dev/posts/announcing-istio-1-28-9-jnb76bnms)