Istio patches AuthorizationPolicy bypass via HTTP/2 method case

Advisory ISTIO-SECURITY-2026-007, published October 15, 2026, fixes GHSA-w44g-8m76-8gc5 (CVSS 7.4): an HTTP/2 request with a lowercased method bypassed DENY rules with methods and ALLOW rules with notMethods. Fixes shipped in 1.31.2, 1.30.6 and 1.29.9, the final release for the 1.29 branch.

• Affected versions: 1.31.0–1.31.1, 1.30.0–1.30.5 and 1.29.0–1.29.8
• The method-case flaw is rated CVSS 7.4
• The release also fixes an Envoy Brotli overflow at CVSS 9.2
• Sidecar and ambient modes are affected; proxies must be restarted