The enterprise distribution of Linkerd brought to you by Buoyant, the creators of Linkerd.
The 2.20.2 stable point release adds official support for Kubernetes 1.36 and Gateway API v1.5.1, and fixes a HAZL bug that caused a small amount of traffic to always be routed cross-zone. This release also updates some dependencies to address reported CVEs in underlying components.
The 2.18.13 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.19.10 point release fixes an issue with FIPS connections from the control plane to the Kubernetes API. This release also updates some dependencies to address reported CVEs in underlying components.
The 2.20.1 stable point release fixes a panic in linkerd policy generate, and
fixes a corner case in proxy behavior where connections to undefined service
ports were incorrectly allowed if a corresponding ServiceProfile existed for
that Service. This release also updates dependencies to address reported CVEs in
underlying components, and provides optional FIPS binaries.
The 2.19.9 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.12 stable point release updates some dependencies to address reported CVEs in underlying components.
Linkerd 2.20 is a new major release that provides automated rotation of mTLS trust anchors; adds support for Windows VMs running outside of Kubernetes; and improves circuit breaking and load balancing (including HAZL) to be aware of rate limits. The 2.20 release also improves memory consumption of the control plane, especially on busy clusters, and promotes native sidecars to be the default deployment model.
The 2.19.8 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.11 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.11 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.19.7 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.10 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.10 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.19.6 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.9 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.9 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.19.5 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.8 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.8 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.19.4 point release fixes an issue with TLS algorithm negotiation that may affect connection establishment with other FIPS proxy versions. It also reduces memory consumption in the destination controller when running federated services with large-scale rollouts.
The 2.19.3 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.7 point release fixes an issue with TLS algorithm negotiation that may affect connection establishment with other FIPS proxy versions. It also reduces memory consumption in the destination controller when running federated services with large-scale rollouts.
The 2.17.7 point release fixes an issue with TLS algorithm negotiation that may affect connection establishment with other FIPS proxy versions.
The 2.19.2 stable point release updates some dependencies to address reported CVEs in underlying components.
golang.org/x/crypto dependency to remediategolang.org/x/crypto dependency to remediateThe 2.19.1 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.5 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.5 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.18.4 stable point release updates some dependencies to address reported CVEs in underlying components.
The 2.17.4 stable point release updates some dependencies to address reported CVEs in underlying components.
Linkerd 2.19 is a new major release that adds support for Windows containers and post-quantum cryptography, improves Linkerd’s supply chain security, and optionally supports FIPS 140-3 validated encryption.
libcrypto3 and libssl3 to remediatelibcrypto3 and libssl3 to remediatelibc6 to remediatelibc6 to remediatelibc6 to remediatelibcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2024-13176golang.org/x/oauth2 to 0.27.0 to remediate
CVE-2025-22868v3.17.4 to remediate
GHSA-557j-xg8c-q2mmThe 2.18.3 stable point release includes bugfixes and minor improvements.
The 2.17.3 stable point release includes bugfixes and minor improvements.
The 2.18.2 stable point release includes a proxy bugfix, adds a signed multiarch
SBOM index, and removes an incorrect deprecation warning in the
linkerd upgrade command.
golang to 1.24.4 for both non-FIPS and FIPS to remediategolang to 1.24.4 for both non-FIPS and FIPS to remediategolang to 1.24.4 for both non-FIPS and FIPS to remediateThe 2.18.1 stable point release includes bugfixes and improvements to HAZL configuration.
libssl3 for both non-FIPS and FIPS to remediate
CVE-2024-13176libssl3 for both non-FIPS and FIPS to remediate
CVE-2024-13176libssl3 for both non-FIPS and FIPS to remediate
CVE-2024-13176The 2.17.2 stable point release addresses CVE-2025-43915 and includes additional dependency upgrades.
The 2.16.5 stable point release addresses CVE-2025-43915 and includes additional dependency upgrades.
0.39.0 to remediatev3.17.3 remediate1.24.2 to remediateLinkerd 2.18 is a new major release that adds GitOps-compatible multicluster linking, improved support for the Gateway API, protocol declarations, and a host of other features and bugfixes.
jwt to remediate
GHSA-mh63-6h87-95cpcontainerd to remediate
GHSA-265r-hfxg-fhmglibc6 in extension-init and policy-controller for FIPS, and in
proxy for both non-FIPS and FIPS to remediate
CVE-2025-0395golang.org/x deps for
GHSA-qxp5-gwg8-xv66jwt to remediate
GHSA-mh63-6h87-95cpcontainerd to remediate
GHSA-265r-hfxg-fhmglibc6 in extension-init and policy-controller for FIPS, and in
proxy for both non-FIPS and FIPS to remediate
CVE-2025-0395golang.org/x deps for
GHSA-qxp5-gwg8-xv66jwt to remediate
GHSA-mh63-6h87-95cpcontainerd to remediate
GHSA-265r-hfxg-fhmglibc6 in extension-init and policy-controller for FIPS, and in
proxy for both non-FIPS and FIPS to remediate
CVE-2025-0395golang.org/x deps for
GHSA-qxp5-gwg8-xv66openssl to 3.1.8 in extension-init and policy-controller FIPS
images to remediatelinkerd jaeger install CLI command outputting an invalid webhook image
nameopenssl to 3.1.8 in extension-init and policy-controller FIPS
images to remediatelinkerd jaeger install CLI command outputting an invalid webhook image
nameopenssl to 3.1.8 in extension-init and policy-controller FIPS
images to remediatelibcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2025-26519libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2025-26519libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2025-26519libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2024-13176libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2024-13176libcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediate CVE-2024-13176The 2.17.1 stable point release includes bugfixes and minor improvements.
The 2.16.4 stable point release includes bugfixes and minor improvements.
controller for both non-FIPS and FIPS to
remediate
GHSA-w32m-9786-jp63controller for both non-FIPS and FIPS to
remediate
GHSA-w32m-9786-jp63controller for both non-FIPS and FIPS to
remediate
GHSA-w32m-9786-jp63controller for both non-FIPS and FIPS to
remediate
GHSA-v778-237x-gjrccontroller for both non-FIPS and FIPS to
remediate
GHSA-v778-237x-gjrccontroller for both non-FIPS and FIPS to
remediate
GHSA-v778-237x-gjrcThe 2.16.3 stable point release includes bugfixes and minor improvements.
The 2.15.7 stable point release includes bugfixes and minor improvements.
Linkerd 2.17 is a new major release that adds rate limiting, federated services, and monitoring and control of egress traffic from the cluster. See our Linkerd 2.17 announcement blog post for more details.
libssl3 in extension-init and policy-controller for FIPS, and in
proxy for both non-FIPS and FIPS to remediatelibcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediatelibssl3 in extension-init and policy-controller for FIPS, and in
proxy for both non-FIPS and FIPS to remediatelibcrypto3 and libssl3 in proxy-init for both non-FIPS and FIPS
to remediateThe 2.16.2 stable point release includes bugfixes and minor improvements.
The 2.16.1 stable point release includes bugfixes and minor improvements.
The 2.15.6 stable point release includes bugfixes and minor improvements.
Linkerd 2.16 is a new major release that adds new retry, timeout, and per-route metrics to HTTPRoute and GRPCRoute types, bringing Linkerd’s Gateway API implementation to feature parity with ServiceProfiles and addressing some long-standing wrinkles with these features. Linkerd 2.16 also adds support for IPv6 and introduces an audit mode for Linkerd’s zero trust network policies.
The 2.15.5 stable point release includes a variety of bug fixes and proxy configuration features, including a fix for CVE-2024-40632.
The 2.15.4 stable point release includes a variety of bug fixes and some minor diagnostic and configuration features.
The 2.15.3 stable point release includes a variety of bug fixes, usability improvements, and new diagnostic and configuration features. It also adjusts the default configuration of the HAZL load balancer to be more aggressive in shifting load to other zones.
The 2.15.2 stable point release includes bug fixes, CVE remediations, and some minor feature updates. It merges HAZL into the main proxy build (previous releases required a separate build), improves certain metrics, and fixes a memory leak in the policy controller.
This is a minor update that is primarily intended to assist Enterprise Plan users who are enabling HAZL.
Linkerd 2.15 is a new major release that adds support for workloads outside of Kubernetes. This new “mesh expansion” feature allows Linkerd users to bring applications running on VMs, physical machines, and other non-Kubernetes locations into the mesh.