v1.9.3

Date: October 26, 2026

Breaking changes

Security updates

• Bumped Envoy to v1.39.5 (from v1.39.1), which includes the fix for CVE-2026-35189 (BoringSSL excessive memory allocation when parsing certificate CRL distribution points), GHSA-8vc2-jrm4-835w and GHSA-47vj-9r25-wv5j (crashes in the OAuth2 and API key auth filters on requests without a :path header), and removes the compromised eMudhra intermediate CAs from the trusted CAs in the Envoy image. Refer to the Envoy v1.39.5 release notes.
• Bumped golang.org/x/net to v0.60.0 to fix CVE-2026-97032, CVE-2026-78659, CVE-2026-78660, CVE-2026-78663 and CVE-2026-78669.

New features

Bug fixes

• Fixed the shutdown-manager failing to create /tmp/shutdown-ready (breaking graceful shutdown and delaying proxy pod termination by the full grace period) when the Envoy container’s securityContext sets readOnlyRootFilesystem: true, by mounting a writable emptyDir at /tmp on the shutdown-manager.
• Fixed obsolete resource snapshots being retained by the backing array of coalesced subscription updates.
• Fixed HTTPS listeners referencing non-existent RouteConfigurations when they share a container port with an HTTP listener that is translated first (for example HTTPS on port 443 and HTTP on port 10443). The HTTPS virtual hosts were added to the HTTP listener’s RouteConfiguration, leaving the HTTPS filter chains without routes.
• Fixed route status conditions being reported in a non-deterministic order when a route parent had errors of more than one condition type, which caused unnecessary route status updates.
• Fixed the listener-level api_key_auth filter being built from the first route that uses API key auth. Rotating that route’s keys no longer forces a listener update that drains long-lived connections on every route of the listener, and a route whose credential Secret has no usable keys now rejects requests instead of accepting the first route’s keys.
• Fixed Service and ServiceImport backends whose EndpointSlices carry both kubernetes.io/service-name and multicluster.kubernetes.io/service-name (as Cilium ClusterMesh creates them): ServiceImport backends no longer report EndpointsNotFound, and Service backends now pick up endpoint changes.
• Fixed an HTTPRoute not being reconciled when an HTTPRouteFilter that it references only from backendRef filters is created or updated, if the rule has no rule-level filters.
• Fixed the Kubernetes provider’s cache scope being random on each start when watch.type is Namespaces, which could leave the controller unable to become Ready or unable to see its own namespace’s Secrets and ConfigMaps in Gateway Namespace Mode; the Helm chart now also grants EndpointSlice read in the controller namespace for this mode.
• Fixed a BackendTrafficPolicy with mergeType being recorded twice in a route’s policy metadata when two of the route’s parentRefs reach the same listener.
• Fixed a route-level SecurityPolicy, BackendTrafficPolicy or EnvoyExtensionPolicy with mergeType set reporting its status on two ancestors for the same parent when the route’s parentRef has no sectionName. The merge results (Merged, or Accepted: False when the merged policy failed to translate) went on one ancestor per listener, while Accepted: True went on the Gateway or ListenerSet itself, so a policy whose merge failed reported both Accepted: False and Accepted: True. The merge results of all listeners are now reported on the parentRef’s ancestor, the same one used without mergeType.
• Fixed route status.parents accumulating duplicate entries until the 32-entry limit when another controller writes status for the same parentRef, by matching parent status entries on both parentRef and controllerName.
• Fixed the Helm chart not granting Secret and EndpointSlice read in the controller namespace when watch.namespaces is set in the default deploy mode, which kept the controller from becoming Ready unless the controller namespace was listed in watch.namespaces.

Performance improvements

Deprecations

Other changes