Cloud Service Mesh release notes

This page contains release notes for each version of Cloud Service Mesh. You can periodically check this page for announcements about new or updated features, bug fixes, known issues, and deprecated functionality.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

July 29, 2026

Managed Cloud Service Mesh
Feature

For the clusters using TRAFFIC_DIRECTOR implementation, IP auto-allocation with DNS Proxy is now supported in Rapid release channel.

July 24, 2026

Managed Cloud Service Mesh
Feature

The Envoy Compressor Filter is now GA in the stable release channel.

July 21, 2026

Managed Cloud Service Mesh
Feature

The Envoy Lua Filter is now available as a preview feature in the stable release channel.

July 15, 2026

1.29.x
Announcement

1.29.5-asm.12 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.12 uses Envoy v1.35.13.

1.29.x
Fixed

Patch 1.29.5-asm.12 contains fixes for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity
CVE-2026-46595 Yes Yes Yes Yes Critical (10.0)
CVE-2026-8376 Yes Yes No Yes Medium (9.8)
CVE-2026-8925 Yes Yes No Yes Medium (9.8)
CVE-2026-39830 Yes Yes Yes Yes Critical (9.1)
CVE-2026-39831 Yes Yes Yes Yes Critical (9.1)
CVE-2026-39832 Yes Yes Yes Yes Critical (9.1)
CVE-2026-39833 Yes Yes Yes Yes Critical (9.1)
CVE-2026-39834 Yes Yes Yes Yes Critical (9.1)
CVE-2026-42496 Yes Yes No Yes Medium (9.1)
CVE-2026-42508 Yes Yes Yes Yes Critical (9.1)
CVE-2026-8924 Yes Yes No Yes Low (9.1)
CVE-2026-8927 Yes Yes No Yes Medium (9.1)
CVE-2026-8286 Yes Yes No Yes Low (8.1)
CVE-2025-69720 Yes Yes No Yes Low (7.8)
CVE-2026-39822 Yes Yes Yes Yes High (7.8)
CVE-2026-39829 Yes Yes Yes Yes High (7.5)
CVE-2026-41992 Yes Yes No Yes Medium (7.5)
CVE-2026-46597 Yes Yes Yes Yes High (7.5)
CVE-2026-9547 Yes Yes No Yes Low (7.4)
CVE-2026-25680 Yes Yes Yes Yes Medium (6.5)
CVE-2026-39827 Yes Yes Yes Yes Medium (6.5)
CVE-2026-8458 Yes Yes No Yes Low (6.5)
CVE-2026-39828 Yes Yes Yes Yes Medium (6.3)
CVE-2026-5704 Yes Yes No Yes Medium (5.5)
CVE-2026-58055 Yes Yes No Yes Medium (5.4)
CVE-2026-39835 Yes Yes Yes Yes Medium (5.3)
CVE-2026-42505 Yes Yes Yes Yes Medium (5.3)
CVE-2026-46598 Yes Yes Yes Yes Medium (5.3)
CVE-2026-41991 Yes Yes No Yes Medium (4.7)
CVE-2025-45582 Yes Yes No Yes Medium (0.0)
1.28.x
Announcement

1.28.10-asm.4 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.4 uses Envoy v1.36.9.

1.28.x
Fixed

Patch 1.28.10-asm.4 contains fixes for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity
CVE-2026-8376 Yes Yes No Yes Medium (9.8)
CVE-2026-8925 Yes Yes No Yes Medium (9.8)
CVE-2026-42496 Yes Yes No Yes Medium (9.1)
CVE-2026-8924 Yes Yes No Yes Low (9.1)
CVE-2026-8927 Yes Yes No Yes Medium (9.1)
CVE-2026-8286 Yes Yes No Yes Low (8.1)
CVE-2025-69720 Yes Yes No Yes Low (7.8)
CVE-2026-39822 Yes Yes Yes Yes High (7.8)
CVE-2026-41992 Yes Yes No Yes Medium (7.5)
CVE-2026-42151 No No No Yes High (7.5)
CVE-2026-42154 No No No Yes High (7.5)
CVE-2026-9547 Yes Yes No Yes Low (7.4)
CVE-2026-8458 Yes Yes No Yes Low (6.5)
CVE-2026-40179 No No No Yes Medium (6.1)
CVE-2026-44903 No No No Yes Medium (6.1)
CVE-2026-5704 Yes Yes No Yes Medium (5.5)
CVE-2026-58055 Yes Yes No Yes Medium (5.4)
CVE-2026-42505 Yes Yes Yes Yes Medium (5.3)
CVE-2026-41991 Yes Yes No Yes Medium (4.7)
CVE-2025-45582 Yes Yes No Yes Medium (0.0)
1.27.x
Announcement

1.27.9-asm.15 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.15 uses Envoy v1.35.13v.

1.27.x
Fixed

Patch 1.27.9-asm.15 contains fixes for the following platform CVEs:

CVE Proxy Control Plane Distroless CNI Severity
CVE-2026-8376 Yes Yes No Yes Medium (9.8)
CVE-2026-8925 Yes Yes No Yes Medium (9.8)
CVE-2026-42496 Yes Yes No Yes Medium (9.1)
CVE-2026-8924 Yes Yes No Yes Low (9.1)
CVE-2026-8927 Yes Yes No Yes Medium (9.1)
CVE-2026-8286 Yes Yes No Yes Low (8.1)