Aspen Mesh Platform 1.21.6-am5 release notes#

Introduction#

These release notes describe the differences between Aspen Mesh 1.21.6-am4 and 1.21.6-am5.

Note

This is a critical release. See Overview of F5 Critical Releases for more information, and treat every release as though it closes a critical gap.

The following table summarizes the impact of critical and high severity vulnerabilities in the data plane across the F5 product portfolio.

F5 Products

Data Plane severity

Data Plane severity

Critical

High

F5 Distributed Cloud Services

No

No

BIG-IP TMOS

Yes

Yes

BIG-IP Access Policy Manager (APM) Clients

No

Yes

BIG-IP SSL Orchestrator

Yes

Yes

F5OS - Appliance

Yes

Yes

F5OS - Chassis

Yes

Yes

BIG-IQ

Yes

Yes

F5 Insight

Yes

Yes

BIG-IP Next for Kubernetes

Yes

Yes

F5 BIG-IP Cloud-Native Network Functions (CNFs)

Yes

Yes

BIG-IP Next for Kubernetes (Host)

Yes

Yes

BIG-IP eBPF Observability (EOB)

No

No

BIG-IP Container Ingress Services (CIS)

No

No

Aspen Mesh

No

No

F5 NGINX Plus

No

Yes

Supported container-orchestration platforms#

This release is officially supported on these container-orchestration platforms and versions:

Platform

Version

Recommended Helm version

Kubernetes

1.35

4.1

Kubernetes

1.34

3.19

Kubernetes

1.33

3.18

Kubernetes

1.26

3.14

Kubernetes

1.27

3.15

Kubernetes

1.28

3.16

Kubernetes

1.29, 1.32

3.17

OpenShift

4.14

3.15

OpenShift

4.16

3.17

OpenShift

4.18

3.19

OpenShift

4.22

4.1

Istio proxy (Envoy) version#

1.29.12

Security updates#

> Click to view table

CVE Number

Bug IDs

Image Names

Package Name

CVE-2010-4756

2521213

simpleserver

libc6

CVE-2018-20796

2521217

simpleserver

libc6

CVE-2019-1010022

2521221

simpleserver

libc6

CVE-2019-1010023

2521225

simpleserver

libc6

CVE-2019-1010024

2521229

simpleserver

libc6

CVE-2019-1010025

2521233

simpleserver

libc6

CVE-2020-8559

2519685, 2521001

citadel, citadel-debug

k8s.io/apimachinery

CVE-2020-8565

2519689

citadel

k8s.io/client-go

CVE-2020-8911

2519485, 2520793

citadel, citadel-debug

github.com/aws/aws-sdk-go

CVE-2020-8912

2519493, 2520801

citadel, citadel-debug

github.com/aws/aws-sdk-go

CVE-2021-46848

2516465

install-cni-debug

libtasn1-6

CVE-2022-2582

2519489, 2520797

citadel, citadel-debug

github.com/aws/aws-sdk-go

CVE-2023-45288

2521401

simpleserver

stdlib

CVE-2023-45289

2521493

simpleserver

stdlib

CVE-2023-45290

2521497

simpleserver

stdlib

CVE-2023-4806

2521133

simpleserver

libc6

CVE-2023-4813

2521137

simpleserver

libc6

CVE-2023-5678

2521277

simpleserver

libssl1.1

CVE-2023-7008

2516453

install-cni-debug

libsystemd0

CVE-2024-0727

2521281

simpleserver

libssl1.1

CVE-2024-13176

2521301

simpleserver

libssl1.1

CVE-2024-2236

2516149

install-cni-debug

libgcrypt20

CVE-2024-24783

2521501

simpleserver

stdlib

CVE-2024-24784

2521505

simpleserver

stdlib

CVE-2024-24785

2521509

simpleserver

stdlib

CVE-2024-24786

2519649, 2520965

citadel, citadel-debug

google.golang.org/protobuf

CVE-2024-24789

2521513

simpleserver

stdlib

CVE-2024-24790

2521393

simpleserver

stdlib

CVE-2024-24791

2521517

simpleserver

stdlib

CVE-2024-2511

2521305

simpleserver

libssl1.1

CVE-2024-2961

2521125

simpleserver

libc6

CVE-2024-33599

2521129

simpleserver

libc6

CVE-2024-33600

2521141

simpleserver

libc6

CVE-2024-33601

2521237

simpleserver

libc6

CVE-2024-33602

2521241

simpleserver

libc6

CVE-2024-34155

2521521

simpleserver

stdlib

CVE-2024-34156

2521405

simpleserver

stdlib

CVE-2024-34158

2521525

simpleserver

stdlib

CVE-2024-45336

2521529

simpleserver

stdlib

CVE-2024-45337

2516557, 2517041, 2517609, 2522053

install-cni-debug, pilot, proxyv2, proxyv2-debug

golang.org/x/crypto

CVE-2024-45338

2516645, 2517129, 2517693, 2518097, 2518985, 2519577, 2520885, 2522141

cert-manager-istio-csr, citadel, citadel-debug, install-cni, install-cni-debug, pilot, proxyv2, proxyv2-debug

golang.org/x/net

CVE-2024-45341

2521649

simpleserver

stdlib

CVE-2024-4741

2521309

simpleserver

libssl1.1

CVE-2024-5535

2521313

simpleserver

libssl1.1

CVE-2024-9143

2521317

simpleserver

libssl1.1

CVE-2025-0167

2515989

install-cni-debug

curl

CVE-2025-0395

2521145

simpleserver

libc6

CVE-2025-0913

2521533

simpleserver

stdlib

CVE-2025-10148

2520025

citadel-debug

curl

CVE-2025-13151

2516461

install-cni-debug

libtasn1-6

CVE-2025-14017

2515933

install-cni-debug

curl

CVE-2025-14524

2515993, 2520037

citadel-debug, install-cni-debug

curl

CVE-2025-14819

2520041

citadel-debug

curl

CVE-2025-14831

2516153

install-cni-debug

libgnutls30

CVE-2025-15079

2515997

install-cni-debug

curl

CVE-2025-15224

2516001

install-cni-debug

curl

CVE-2025-15281

2516073, 2519385, 2520221, 2521245

citadel, citadel-debug, install-cni-debug, simpleserver

libc-bin, libc6

CVE-2025-15467

2516321

install-cni-debug

libssl3

CVE-2025-15661

2520501

citadel-debug

libssh2-1

CVE-2025-22866

2521537

simpleserver

stdlib

CVE-2025-22870

2518121, 2519601, 2520909, 2521541

cert-manager-istio-csr, citadel, citadel-debug, simpleserver

golang.org/x/net, stdlib

CVE-2025-22871

2521545

simpleserver

stdlib

CVE-2025-22872

2518125, 2519605, 2520913

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/net

CVE-2025-22873

2521549

simpleserver

stdlib

CVE-2025-27144

2516953, 2517029, 2517597, 2519293, 2522013

install-cni, install-cni-debug, pilot, proxyv2, proxyv2-debug

github.com/go-jose/go-jose/v3

CVE-2025-27587

2521321

simpleserver

libssl1.1

CVE-2025-45582

2516521

install-cni-debug

tar

CVE-2025-4673

2521553

simpleserver

stdlib

CVE-2025-47906

2521557

simpleserver

stdlib

CVE-2025-47907

2521561

simpleserver

stdlib

CVE-2025-47911

2515753, 2518129, 2519609, 2520917

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2025-47912

2518281, 2521565

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-47913

2518017, 2519497, 2520805

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2025-47914

2518061, 2519541, 2520849

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2025-4802

2521149

simpleserver

libc6

CVE-2025-5278

2515929

install-cni-debug

coreutils

CVE-2025-54410

2517021, 2517589, 2522005

pilot, proxyv2, proxyv2-debug

github.com/docker/docker

CVE-2025-58181

2518065, 2519545, 2520853

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2025-58183

2518285, 2521569

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58185

2518289, 2521573

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58186

2518365, 2521653

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58187

2518293, 2521577

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58188

2518297, 2521581

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58189

2518301, 2521585

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-58190

2515757, 2518133, 2519613, 2520921

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2025-6141

2516233

install-cni-debug

libncurses6

CVE-2025-61723

2518305, 2521589

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-61724

2518309, 2521593

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-61725

2518313, 2521597

cert-manager-istio-csr, simpleserver

stdlib

CVE-2025-61726

2515785, 2518205, 2519697, 2521009, 2521409

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2025-61727

2515861, 2518317, 2521601

cert-manager-istio-csr, dns-controller, simpleserver

stdlib

CVE-2025-61728

2515865, 2518321, 2519769, 2521077, 2521605

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2025-61729

2515789, 2518209, 2521413

cert-manager-istio-csr, dns-controller, simpleserver

stdlib

CVE-2025-61730

2515869, 2518325, 2519773, 2521081, 2521609

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2025-6297

2520069

citadel-debug

dpkg

CVE-2025-68121

2515781, 2518201, 2519693, 2521005, 2521397

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2025-68160

2516345, 2521325

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2025-68973

2516049

install-cni-debug

gpgv

CVE-2025-69418

2516349, 2521329

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2025-69419

2516353, 2521285

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2025-69420

2516357, 2521333

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2025-69421

2516361, 2521253

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2025-69720

2516237

install-cni-debug

libncurses6

CVE-2025-8058

2521153

simpleserver

libc6

CVE-2025-8277

2516305

install-cni-debug

libssh-4

CVE-2025-9230

2521289

simpleserver

libssl1.1

CVE-2025-9820

2516205

install-cni-debug

libgnutls30

CVE-2026-0861

2516077, 2519389, 2520225, 2521249

citadel, citadel-debug, install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-0915

2516081, 2519297, 2520133, 2521157

citadel, citadel-debug, install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-0964

2516265

install-cni-debug

libssh-4

CVE-2026-0965

2516309

install-cni-debug

libssh-4

CVE-2026-0966

2516313

install-cni-debug

libssh-4

CVE-2026-0967

2516269

install-cni-debug

libssh-4

CVE-2026-0968

2516273

install-cni-debug

libssh-4

CVE-2026-11850

2516209

install-cni-debug

libgssapi-krb5-2

CVE-2026-11856

2515937

install-cni-debug

curl

CVE-2026-12087

2516481

install-cni-debug

perl-base

CVE-2026-13221

2516485

install-cni-debug

perl-base

CVE-2026-13595

2515913

install-cni-debug

bsdextrautils

CVE-2026-13757

2516249

install-cni-debug

libp11-kit0

CVE-2026-15059

2516433

install-cni-debug

libsystemd0

CVE-2026-15534

2516489

install-cni-debug

perl-base

CVE-2026-16742

2516437

install-cni-debug

libsystemd0

CVE-2026-18374

2521161

simpleserver

libc6

CVE-2026-18938

2516253

install-cni-debug

libp11-kit0

CVE-2026-19487

2516493

install-cni-debug

perl-base

CVE-2026-19499

2521165

simpleserver

libc6

CVE-2026-19542

2516089, 2521169

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-1965

2515945

install-cni-debug

curl

CVE-2026-2219

2520065

citadel-debug

dpkg

CVE-2026-22795

2516365, 2521337

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-22796

2516369, 2521341

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-24051

2518009

cert-manager-istio-csr

go.opentelemetry.io/otel/sdk

CVE-2026-25679

2515793, 2518213, 2519701, 2521013, 2521417

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-25680

2515761, 2518137, 2520925

cert-manager-istio-csr, citadel-debug, dns-controller

golang.org/x/net

CVE-2026-25681

2515733, 2518101, 2519581, 2520889

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2026-27135

2516241, 2520405

citadel-debug, install-cni-debug

libnghttp2-14

CVE-2026-27136

2515737, 2518105, 2519585, 2520893

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2026-27139

2515909, 2518369, 2519813, 2521121, 2521657

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-27142

2515873, 2518329, 2519777, 2521085, 2521613

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-27145

2515797, 2518217, 2519705, 2521017, 2521421

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-27456

2515917

install-cni-debug

bsdextrautils

CVE-2026-28387

2516373, 2519401, 2521257

citadel, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-28388

2516377, 2519405, 2521261

citadel, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-28389

2516381, 2519409, 2521265

citadel, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-28390

2516385, 2519413, 2521269

citadel, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-29111

2516441, 2520589

citadel-debug, install-cni-debug

libsystemd0

CVE-2026-31789

2516389, 2519397

citadel, install-cni-debug

libssl3

CVE-2026-31790

2516325, 2519421

citadel, install-cni-debug

libssl3

CVE-2026-32280

2515801, 2518221, 2519709, 2521021, 2521425

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32281

2515805, 2518225, 2519713, 2521025, 2521429

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32282

2515877, 2518333, 2519781, 2521089, 2521617

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32283

2515809, 2518229, 2519717, 2521029, 2521433

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32288

2515881, 2518337, 2519785, 2521093, 2521621

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32289

2515885, 2518341, 2519789, 2521097, 2521625

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-32952

2517993

cert-manager-istio-csr

github.com/Azure/go-ntlmssp

CVE-2026-33186

2518157, 2519629, 2520945

cert-manager-istio-csr, citadel, citadel-debug

google.golang.org/grpc

CVE-2026-33811

2515813, 2518233, 2519721, 2521033, 2521437

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-33814

2515741, 2518109, 2519589, 2520897, 2521441

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

golang.org/x/net, stdlib

CVE-2026-33818

2515817, 2518237, 2518805, 2519725, 2519817, 2521037, 2521445, 2521677, 2521709, 2523461

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-33845

2516157, 2520277

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-33846

2516161, 2520285

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-33997

2517013, 2517581, 2522001

pilot, proxyv2, proxyv2-debug

github.com/docker/docker

CVE-2026-34180

2516393, 2519445, 2520541, 2521345

citadel, citadel-debug, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-34182

2516329, 2519425, 2520521

citadel, citadel-debug, install-cni-debug

libssl3

CVE-2026-34743

2516225, 2520397

citadel-debug, install-cni-debug

liblzma5

CVE-2026-34986

2516949, 2517025, 2517593, 2518001, 2519289, 2522009

cert-manager-istio-csr, install-cni, install-cni-debug, pilot, proxyv2, proxyv2-debug

github.com/go-jose/go-jose/v3

CVE-2026-35469

2518005

cert-manager-istio-csr

github.com/moby/spdystream

CVE-2026-35535

2516517

install-cni-debug

sudo

CVE-2026-3731

2516277

install-cni-debug

libssh-4

CVE-2026-3783

2515953, 2519973

citadel-debug, install-cni-debug

curl

CVE-2026-3784

2516005, 2519977

citadel-debug, install-cni-debug

curl

CVE-2026-3832

2516165

install-cni-debug

libgnutls30

CVE-2026-3833

2516169, 2520289

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-39350

2519677, 2520993

citadel, citadel-debug

istio.io/istio

CVE-2026-39820

2515821, 2518241, 2519729, 2521041, 2521449

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39821

2515745, 2518113, 2518809, 2519593, 2519821, 2520901, 2521453, 2521681, 2521713, 2523465

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

golang.org/x/net, stdlib

CVE-2026-39822

2515825, 2518245, 2519733, 2521045, 2521457

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39823

2515889, 2518345, 2519793, 2521101, 2521629

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39824

2515773, 2518149, 2519625, 2520937

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/sys

CVE-2026-39825

2515893, 2518349, 2519797, 2521105, 2521633

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39826

2515897, 2518353, 2519801, 2521109, 2521637

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39827

2518069, 2519549, 2520857

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39828

2518021, 2519501, 2520809

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39829

2518025, 2519505, 2520813

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39830

2518029, 2519509, 2520817

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39831

2518033, 2519513, 2520821

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39832

2518037, 2519517, 2520825

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39833

2518073, 2519553, 2520861

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39834

2518077, 2519557, 2520865

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39835

2518041, 2519521, 2520829

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-39836

2515829, 2518249, 2519737, 2521049, 2521461

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-39883

2518013

cert-manager-istio-csr

go.opentelemetry.io/otel/sdk

CVE-2026-40225

2516445, 2520593

citadel-debug, install-cni-debug

libsystemd0

CVE-2026-40226

2516449, 2520597

citadel-debug, install-cni-debug

libsystemd0

CVE-2026-40355

2516213, 2520329

citadel-debug, install-cni-debug

libgssapi-krb5-2

CVE-2026-40356

2516217, 2520333

citadel-debug, install-cni-debug

libgssapi-krb5-2

CVE-2026-4046

2516093, 2519313, 2520149, 2521173

citadel, citadel-debug, install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-4105

2520601

citadel-debug

libsystemd0

CVE-2026-41413

2518197, 2519681, 2520997

cert-manager-istio-csr, citadel, citadel-debug

istio.io/istio

CVE-2026-41567

2517005, 2517573, 2521993

pilot, proxyv2, proxyv2-debug

github.com/docker/docker

CVE-2026-41568

2517017, 2517585

proxyv2, proxyv2-debug

github.com/docker/docker

CVE-2026-41989

2516145, 2520265

citadel-debug, install-cni-debug

libgcrypt20

CVE-2026-41991

2516053

install-cni-debug

gzip

CVE-2026-41992

2516057

install-cni-debug

gzip

CVE-2026-42009

2516173, 2520293

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42010

2516177, 2520281

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42011

2516181, 2520297

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42012

2516185, 2520301

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42013

2516189, 2520305

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42014

2516193, 2520309

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42015

2516197, 2520313

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-42250

2516069

install-cni-debug

libbz2-1.0

CVE-2026-42306

2517009, 2517577, 2521997

pilot, proxyv2, proxyv2-debug

github.com/docker/docker

CVE-2026-42496

2516497

install-cni-debug

perl-base

CVE-2026-42499

2515833, 2518253, 2519741, 2521053, 2521465

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-42502

2515765, 2518141, 2519617, 2520929

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2026-42504

2515837, 2518257, 2519745, 2521057, 2521469

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-42505

2515901, 2518357, 2519805, 2521113, 2521641

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-42506

2515769, 2518145, 2519621, 2520933

cert-manager-istio-csr, citadel, citadel-debug, dns-controller

golang.org/x/net

CVE-2026-42507

2515905, 2518361, 2519809, 2521117, 2521645

cert-manager-istio-csr, citadel, citadel-debug, dns-controller, simpleserver

stdlib

CVE-2026-42508

2518045, 2519525, 2520833

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-42766

2516397, 2519449, 2520545, 2521349

citadel, citadel-debug, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-42767

2516401

install-cni-debug

libssl3

CVE-2026-42770

2516405, 2519457, 2520553

citadel, citadel-debug, install-cni-debug

libssl3

CVE-2026-4437

2519317, 2520153

citadel, citadel-debug

libc-bin, libc6

CVE-2026-4438

2519393, 2520229

citadel, citadel-debug

libc-bin, libc6

CVE-2026-45445

2516333, 2519429, 2520525

citadel, citadel-debug, install-cni-debug

libssl3

CVE-2026-45446

2516409, 2519461, 2520557

citadel, citadel-debug, install-cni-debug

libssl3

CVE-2026-45447

2516317, 2519417, 2520517, 2521273

citadel, citadel-debug, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-46595

2518049, 2519529, 2520837

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-46597

2518053, 2519533, 2520841

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-46598

2518081, 2519561, 2520869

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-46600

2515749, 2518117, 2518813, 2519597, 2519825, 2520905, 2521685, 2521717, 2523469

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator

golang.org/x/net, stdlib

CVE-2026-4873

2516009

install-cni-debug

curl

CVE-2026-4878

2516129, 2520233

citadel-debug, install-cni-debug

libcap2

CVE-2026-5260

2516201, 2520317

citadel-debug, install-cni-debug

libgnutls30

CVE-2026-53613

2515921

install-cni-debug

bsdextrautils

CVE-2026-53615

2515925

install-cni-debug

bsdextrautils

CVE-2026-53910

2516041

install-cni-debug

diffutils

CVE-2026-5419

2520325

citadel-debug

libgnutls30

CVE-2026-5435

2516097, 2521177

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-54371

2516061

install-cni-debug

libattr1

CVE-2026-54411

2516257

install-cni-debug

libpam-modules

CVE-2026-5450

2516101, 2521181

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-54874

2516413, 2521353

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-5545

2515957

install-cni-debug

curl

CVE-2026-56852

2515777, 2518153, 2520941

cert-manager-istio-csr, citadel-debug, dns-controller

golang.org/x/text

CVE-2026-56853

2515841, 2518261, 2518817, 2519749, 2519829, 2521061, 2521473, 2521689, 2521721, 2523473

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-56854

2518057, 2519537, 2520845

cert-manager-istio-csr, citadel, citadel-debug

golang.org/x/crypto

CVE-2026-56855

2518085

cert-manager-istio-csr

golang.org/x/crypto

CVE-2026-56858

2515845, 2518265, 2518821, 2519753, 2519833, 2521065, 2521477, 2521693, 2521725, 2523477

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-56859

2515849, 2518269, 2518825, 2519757, 2519837, 2521069, 2521481, 2521697, 2521729, 2523481

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-56860

2515853, 2518273, 2518829, 2519761, 2519841, 2521485, 2521701, 2521733, 2523485

cert-manager-istio-csr, citadel, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-56862

2515857, 2518277, 2518833, 2519765, 2519845, 2521073, 2521489, 2521705, 2521737, 2523489

cert-manager-istio-csr, citadel, citadel-debug, diameter-client, diameter-server, dns-controller, packet-inspector-1-analysis-em, packet-inspector-2-analysis-em, packet-inspector-aggregator, simpleserver

stdlib

CVE-2026-5704

2516533

install-cni-debug

tar

CVE-2026-57432

2516501

install-cni-debug

perl-base

CVE-2026-57433

2516505

install-cni-debug

perl-base

CVE-2026-5773

2516013, 2519929

citadel-debug, install-cni-debug

curl

CVE-2026-58050

2520493

citadel-debug

libssh2-1

CVE-2026-58051

2520505

citadel-debug

libssh2-1

CVE-2026-58055

2516245

install-cni-debug

libnghttp2-14

CVE-2026-5928

2516105, 2521185

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-5958

2516513, 2520729

citadel-debug, install-cni-debug

sed

CVE-2026-59843

2516281

install-cni-debug

libssh-4

CVE-2026-59845

2516285

install-cni-debug

libssh-4

CVE-2026-59846

2516289

install-cni-debug

libssh-4

CVE-2026-59847

2516293

install-cni-debug

libssh-4

CVE-2026-59848

2516297

install-cni-debug

libssh-4

CVE-2026-59850

2516301

install-cni-debug

libssh-4

CVE-2026-6238

2516109, 2521189

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-6253

2515961

install-cni-debug

curl

CVE-2026-6276

2516017

install-cni-debug

curl

CVE-2026-63072

2516337, 2521293

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-63074

2516417, 2521357

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-63076

2516341, 2521297

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-6368

2516113, 2521193

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-6429

2515965

install-cni-debug

curl

CVE-2026-66032

2520509

citadel-debug

libssh2-1

CVE-2026-66034

2520513

citadel-debug

libssh2-1

CVE-2026-6791

2516117, 2521197

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-7168

2515969, 2519997

citadel-debug, install-cni-debug

curl

CVE-2026-7383

2516421, 2519473, 2520569, 2521361

citadel, citadel-debug, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-75803

2516425, 2521365

install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-7598

2520497

citadel-debug

libssh2-1

CVE-2026-77117

2516121, 2521201

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-78662

2518089

cert-manager-istio-csr

golang.org/x/crypto

CVE-2026-80489

2516125, 2521205

install-cni-debug, simpleserver

libc-bin, libc6

CVE-2026-8286

2516021

install-cni-debug

curl

CVE-2026-8376

2516509

install-cni-debug

perl-base

CVE-2026-84303

2518173, 2518801, 2519645, 2520961, 2521673

cert-manager-istio-csr, citadel, citadel-debug, packet-inspector-2-analysis-em, packet-inspector-aggregator

google.golang.org/grpc

CVE-2026-84304

2518161, 2518793, 2519633, 2520949, 2521665

cert-manager-istio-csr, citadel, citadel-debug, packet-inspector-2-analysis-em, packet-inspector-aggregator

google.golang.org/grpc

CVE-2026-84445

2518165, 2518797, 2519637, 2520953, 2521669

cert-manager-istio-csr, citadel, citadel-debug, packet-inspector-2-analysis-em, packet-inspector-aggregator

google.golang.org/grpc

CVE-2026-8458

2516025

install-cni-debug

curl

CVE-2026-86145

2520469

citadel-debug

libpcre2-8-0

CVE-2026-89092

2521209

simpleserver

libc6

CVE-2026-89156

2520485

citadel-debug

libpcre2-8-0

CVE-2026-89157

2520477

citadel-debug

libpcre2-8-0

CVE-2026-89158

2520481

citadel-debug

libpcre2-8-0

CVE-2026-89160

2520489

citadel-debug

libpcre2-8-0

CVE-2026-89161

2520473

citadel-debug

libpcre2-8-0

CVE-2026-8924

2516029

install-cni-debug

curl

CVE-2026-8925

2515981

install-cni-debug

curl

CVE-2026-8927

2515985

install-cni-debug

curl

CVE-2026-8932

2516033

install-cni-debug

curl

CVE-2026-9076

2516429, 2519481, 2520577, 2521369

citadel, citadel-debug, install-cni-debug, simpleserver

libssl1.1, libssl3

CVE-2026-9547

2516037

install-cni-debug

curl

Other changes#

Istio#

(No changes)

Aspen Mesh Platform features#

  • ASM-5458: The Packet Inspector 1 Aggregator now supports multi-destination packet forwarding, enabling the aggregator to send identical packet captures to up to five analysis destinations simultaneously (one primary and up to four secondaries).

    To enable multi-destination mode, add secondary destination addresses to the addressesSecondary list in the Packet Inspector 1 aggregator override values file and run helm upgrade. The aggregator automatically reuses the primary TLS certificates for secondaries in the same Istio trust domain. For secondaries using a different Certificate Authority (CA), provide per-destination certificate paths using certPathsSecondary, clientCertPathsSecondary, and clientKeyPathsSecondary.

    A new Prometheus metric, aspenmesh_packet_inspector_requests_to_secondary_analysis_total, tracks secondary delivery success and failure counts.

    Important

    This feature is backward-compatible. Existing single-destination deployments work without any configuration changes when addressesSecondary is empty or omitted. Multi-destination applies to Packet Inspector 1 only. Packet Inspector 2 is not supported.

  • ASM-5508: Added istioctl-lite, a new reduced-functionality CLI binary included in the Aspen Mesh release tarball alongside istioctl. Use istioctl-lite to diagnose and troubleshoot the service mesh without the ability to install, modify, or remove it. This binary is intended for environments where you need to separate operational duties from administrative duties.

    The following table shows which commands are available in istioctl-lite:

    Command

    Available

    Description

    analyze

    ✅

    Analyze Istio configuration for potential issues

    authz

    ✅

    Troubleshoot authorization policies

    bug-report

    ✅

    Capture cluster diagnostics and logs for support cases

    completion

    ✅

    Generate shell autocompletion scripts (bash/zsh)

    experimental

    ✅

    Access experimental commands

    help

    ✅

    Display help for any command

    proxy-config

    ✅

    Inspect Envoy sidecar configuration (clusters, listeners, routes, endpoints)

    proxy-status

    ✅

    Check synchronization status between the control plane and Envoy sidecars

    remote-clusters

    ✅

    List remote clusters connected to the control plane

    validate

    ✅

    Validate Istio manifests before applying them

    verify-install

    ✅

    Confirm the control plane is installed and healthy

    version

    ✅

    Display client and control plane version information

    admin

    ❌

    Control plane configuration management

    create-remote-secret

    ❌

    Multi-cluster secret creation

    dashboard

    ❌

    Access Istio web UIs

    install

    ❌

    Install or reconfigure the mesh

    kube-inject

    ❌

    Inject sidecars into pod manifests

    manifest

    ❌

    Manifest generation

    operator

    ❌

    Istio operator controller commands

    profile

    ❌

    Configuration profile management

    tag

    ❌

    Revision tag management

    uninstall

    ❌

    Remove the mesh

    upgrade

    ❌

    In-place mesh upgrades

    If you run a removed command, istioctl-lite returns an “unknown command” error and exits with a non-zero status code. No part of the removed command’s action is performed.

    Important

    istioctl-lite is available only in Aspen Mesh 1.21.6-am5 and later. The command set is fixed at build time and cannot be changed through configuration.

    To extract and verify the binary:

    tar -xzf aspenmesh-carrier-grade-<version>.tar.gz
ls */bin/istioctl-lite
./istioctl-lite version --remote=false -o json

  • ASM-5325: Protect your services from identity spoofing by upgrading to Aspen Mesh 1.21.6-am5, which enforces SANITIZE_SET as the default X-Forwarded-Client-Cert (XFCC) header handling mode for ingress/egress gateways and sidecar inbound listeners. With this change, the proxy automatically discards any client-supplied XFCC header and replaces it with a verified entry based on the authenticated TLS certificate, ensuring your services always receive trusted client identity information without additional configuration.

    To customize the XFCC handling mode, update the following values in your Aspen Mesh override values file:

    meshConfig:
  defaultConfig:
    # Applies to ingress/egress gateway HCM
    gatewayTopology:
      forwardClientCertDetails: <VALUE>
    # Applies to sidecar inbound HCM
    proxyHeaders:
      forwardedClientCert: <VALUE>

    VALUE

    Description

    UNDEFINED

    Field is not set.

    SANITIZE

    Do not send the XFCC header to the next hop.

    FORWARD_ONLY

    When the client connection is mTLS (Mutual TLS), forward the XFCC header in the request.

    APPEND_FORWARD

    When the client connection is mTLS, append the client certificate information to the request’s XFCC header and forward it.

    SANITIZE_SET

    When the client connection is mTLS, reset the XFCC header with the client certificate information and send it to the next hop. This is the default value for a gateway.

    ALWAYS_FORWARD_ONLY

    Always forward the XFCC header in the request, regardless of whether the client connection is mTLS.

    After updating the override file, apply the changes by upgrading istiod:

    helm upgrade istiod manifests/charts/istio-control/istio-discovery \
  --namespace istio-system \
  --values aspen-mesh-override-values.yaml

Known issues#

(No known issues)