istio-csr integrates cert-manager into Istio, allowing you to issue workload certificates using the power of cert-manager.
Security
We recommend upgrading. v0.17.0 is affected by CVE-2026-84304 / GO-2026-6348, a HIGH severity denial of service in gRPC-Go. An unauthenticated remote attacker who can open a gRPC stream can fragment a payload into millions of tiny HTTP/2 DATA frames. Each fragment carries memory overhead, so the heap grows far beyond the flow-control windows and the process runs out of memory. govulncheck traces this into the istio-csr serving listener through pkg/server/server.go.
v0.18.0 ships google.golang.org/grpc v1.83.2, which fixes it. govulncheck reports no called vulnerabilities against this release.
Two other gRPC advisories show up in scans of v0.17.0 and are also fixed by that bump. Neither affects istio-csr:
- CVE-2026-84445 / GO-2026-6443 only affects servers built with
xds.NewGRPCServer(), which install an xDS routing interceptor. istio-csr uses plaingrpc.NewServer, so the panicking code path does not exist here. govulncheck still reports it, because the symbol it matches on sits in the shared HTTP/2 transport. - CVE-2026-84303 is reported by trivy at MEDIUM and is not called by istio-csr.
The release also picks up fixes in dependencies that istio-csr does not call: golang.org/x/crypto v0.56.0 (CVE-2026-56855, CVE-2026-78662), go.opentelemetry.io/otel/sdk v1.45.0 (CVE-2026-81870) and github.com/google/cel-go v0.30.0.
A trivy scan of the published quay.io/jetstack/cert-manager-istio-csr:v0.18.0 image reports no findings at any severity, other than the standing GO-2026-5932 notice that golang.org/x/crypto/openpgp is unmaintained. No fixed version of that exists and istio-csr does not use the package.
This release is built with Go 1.27.1, up from Go 1.26.6 in v0.17.0. That bump is not itself a security fix: govulncheck found no standard library vulnerabilities in v0.17.0 as it was built.
Highlights
- You can now set the minimum TLS version, the cipher suites and the curve preferences for the gRPC serving listener (#787, @arun717). Use the
--serving-tls-min-version,--serving-tls-cipher-suitesand--serving-tls-curve-preferencesflags, or theapp.tls.servingTLSMinVersion,app.tls.servingTLSCipherSuitesandapp.tls.servingTLSCurvePreferencesHelm values. No defaults change. Leave the values empty and Go's defaults still apply. - Istio APIs updated to v1.31.0, Kubernetes libraries to v0.37.0, controller-runtime to v0.25.1 and cert-manager to v1.21.2.
What's Changed
- chore(deps): update makefile modules to 24aa843 by @renovate[bot] in #893
- fix(deps): update module github.com/stretchr/testify to v1.12.0 by @renovate[bot] in #892
- Support configurable min TLS version, cipher suites, and curves for istio-csr by @arun717 in #787
- chore(deps): update module github.com/google/cel-go to v0.30.0 [security] by @renovate[bot] in #894
- chore(deps): update makefile modules to ca8dd5c by @renovate[bot] in #895
- chore(deps): update makefile modules to 4dc1d67 by @renovate[bot] in #897
- fix(deps): update module google.golang.org/grpc to v1.83.1 by @renovate[bot] in #898
- chore(deps): update makefile modules to b903033 by @renovate[bot] in #899
- chore(deps): update makefile modules to 62d18d0 by @renovate[bot] in #901
- chore(deps): update makefile modules to 4c69ed4 by @renovate[bot] in #904
- fix(deps): update kubernetes go patches to v0.36.4 by @renovate[bot] in #902
- chore(deps): update makefile modules to c236200 by @renovate[bot] in #905
- fix(deps): update misc go deps by @renovate[bot] in #900
- fix(deps): update kubernetes go deps to v0.37.0 by @renovate[bot] in #907
- chore(deps): update makefile modules to 1745d14 by @renovate[bot] in #908
- fix(deps): update module github.com/onsi/gomega to v1.43.0 by @renovate[bot] in #909
- fix(deps): update module google.golang.org/grpc to v1.83.2 by @renovate[bot] in #906
- fix(deps): update module istio.io/api to v1.31.0 by @renovate[bot] in #910
- chore(deps): update makefile modules to 44a7b02 by @renovate[bot] in #911
- chore(deps): update module golang.org/x/crypto to v0.56.0 [security] by @renovate[bot] in #912
- chore(deps): update makefile modules to 8817d0f by @renovate[bot] in #913
- chore(deps): update makefile modules to 7b9a8ef by @renovate[bot] in #914
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.0 by @renovate[bot] in #915
- chore(deps): update makefile modules to a0a1cfe by @renovate[bot] in #916
- chore(deps): update makefile modules to 667adb4 by @renovate[bot] in #917
- chore(deps): update makefile modules to 3db3dfa by @renovate[bot] in #918
- chore(deps): update makefile modules to 3802a00 by @renovate[bot] in #919
- chore(deps): update makefile modules to 11349e7 by @renovate[bot] in #920
- fix(deps): update module github.com/cert-manager/cert-manager to v1.21.2 by @renovate[bot] in #921
- fix(deps): update module github.com/onsi/ginkgo/v2 to v2.32.2 by @renovate[bot] in #923
- chore(deps): update makefile modules to 56bbaca by @renovate[bot] in #922
- chore(deps): update makefile modules to d983bab by @renovate[bot] in #924
- fix(deps): update module sigs.k8s.io/controller-runtime to v0.25.1 by @renovate[bot] in #926
- chore(deps): update module go.opentelemetry.io/otel/sdk to v1.45.0 [security] by @renovate[bot] in #927
- chore(deps): update makefile modules to 91ea1cc by @renovate[bot] in #925
New Contributors
Full Changelog: v0.17.0...v0.18.0
Artifacts
- Container image:
quay.io/jetstack/cert-manager-istio-csr:v0.18.0 - Helm chart (OCI):
quay.io/jetstack/charts/cert-manager-istio-csr:v0.18.0