Buoyant Enterprise for Linkerd | Release notes

enterprise-2.20.2

Wed, 26 Aug 2026 00:00:00 +0000

The 2.20.2 stable point release adds official support for Kubernetes 1.36 and Gateway API v1.5.1, and fixes a HAZL bug that caused a small amount of traffic to always be routed cross-zone. This release also updates some dependencies to address reported CVEs in underlying components.

Previous release: enterprise-2.20.1.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.31, and the maximum supported Kubernetes version has been increased to 1.36.

Who should upgrade?

Users who have HAZL enabled should upgrade as soon as possible, as this release corrects zone spillage along with the connection churn and elevated proxy CPU that accompanied it. Users running Kubernetes 1.36 or Gateway API v1.5.1 should also upgrade.

Other users may upgrade to this release at their convenience to take advantage of the fixes and addressed CVEs.

Upgrade guidance

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.5 or later.

Changelog

Added official support for Kubernetes 1.36.
Added support for Gateway API v1.5.1.
Fixed a HAZL bug where a small amount of traffic was always sent cross-zone, causing endpoint and connection churn that increased latency and proxy CPU usage.
Update golang to remediate
Update oras.land/oras-go/v2 to remediate
- GHSA-fxhp-mv3v-67qp
Update github.com/klauspost/compress to remediate
- GO-2026-5841
Update go.opentelemetry.io/otel to remediate
- GO-2026-5158 (maps to CVE-2026-41178)

enterprise-2.18.13

Fri, 21 Aug 2026 00:00:00 +0000

The 2.18.13 stable point release updates some dependencies to address reported CVEs in underlying components.

FIPS users who are upgrading from 2.18 to 2.19 must follow a specific sequence to preserve zero-downtime upgrades. You must first upgrade to 2.18.7 or later, and then to 2.19.4 or later.

Previous release: enterprise-2.18.12.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.22, and the maximum supported Kubernetes version remains 1.32.

Who should upgrade?

This is a CVE hygiene release and does not fix any known exploitable vulnerabilities with Linkerd. Users may upgrade to this release at their convenience.

Upgrade guidance

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.5 or later.

Changelog

Update golang to remediate
- GO-2026-6218
- GO-2026-6091
- GO-2026-6090
- GO-2026-6089
- GO-2026-6088
- GO-2026-5972
- GO-2026-5942
- GO-2026-5856 (maps to CVE-2026-42505)
- GO-2026-5026
- GO-2026-4970 (maps to CVE-2026-39822)
Update oras.land/oras-go/v2 to remediate
Update google.golang.org/grpc to remediate
- GHSA-hrxh-6v49-42gf
Update openssl to remediate
Update opentelemetry to remediate
- GHSA-w9wp-h8wv-79jx
Update rustls-webpki dependency to remediate
- GHSA-82j2-j2ch-gfr8
- GHSA-pwjx-qhcg-rvj4
Update to hickory-proto to remediate
- GHSA-q2qq-hmj6-3wpp
Update time to remediate
- GHSA-r6v5-fh4h-64xc
Update bytes to remediate
- GHSA-434x-w66g-qw3r

enterprise-2.19.10

Mon, 10 Aug 2026 00:00:00 +0000

The 2.19.10 point release fixes an issue with FIPS connections from the control plane to the Kubernetes API. This release also updates some dependencies to address reported CVEs in underlying components.

FIPS users who are upgrading from 2.18 to 2.19 must follow a specific sequence to preserve zero-downtime upgrades. You must first upgrade to 2.18.7 or later, and then to 2.19.4 or later.

Previous release: enterprise-2.19.9.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.29, and the maximum supported Kubernetes version remains 1.35.

Who should upgrade?

Users who run the FIPS-validated version of BEL should upgrade to this release when feasible.

Other users may upgrade to this release at their convenience to take advantage of the addressed CVEs.

Upgrade guidance

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.5 or later.

Changelog

Fixed an issue with FIPS connections from the control plane to the Kubernetes API.
Update golang to remediate
- GO-2026-5856 (maps to CVE-2026-42505)
- GO-2026-4970 (maps to CVE-2026-39822)
Update golang.org/x/text to remediate
- GO-2026-5970 (maps to CVE-2026-56852)
Update github.com/klauspost/compress to remediate
- GO-2026-5841
Update go.opentelemetry.io/otel to remediate
- GO-2026-5158 (maps to CVE-2026-41178)
Update oras.land/oras-go/v2 to remediate
Update google.golang.org/grpc to remediate
- GHSA-hrxh-6v49-42gf
Update opentelemetry to remediate
- GHSA-w9wp-h8wv-79jx
Update rustls-webpki dependency to remediate
- GHSA-82j2-j2ch-gfr8
- GHSA-pwjx-qhcg-rvj4
Update to hickory-proto to remediate
- GHSA-q2qq-hmj6-3wpp

enterprise-2.20.1

Fri, 24 Jul 2026 00:00:00 +0000

The 2.20.1 stable point release fixes a panic in linkerd policy generate, and fixes a corner case in proxy behavior where connections to undefined service ports were incorrectly allowed if a corresponding ServiceProfile existed for that Service. This release also updates dependencies to address reported CVEs in underlying components, and provides optional FIPS binaries.

This release technically contains a minor breaking change, in service of conforming to the stated documentation. Since Linkerd 2.19, the documented behavior with respect to ports that are not declared in a Service spec is to match the behavior of kubeproxy: Linkerd should deny connections to those ports. However, the original implementation of this behavior incorrectly allowed those connections if a ServiceProfile existed.

In this release, we’ve fixed Linkerd’s behavior to match the documentation: connections to ports that are not defined in the Service spec are now denied, even when a ServiceProfile exists for that Service. See Upgrade guidance below for details.

Previous release: enterprise-2.20.0.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.31, and the maximum supported Kubernetes version remains 1.35.

Who should upgrade?

Customers who require FIPS support or need bug fixes introduced in 2.20 should upgrade when feasible.

Other users may upgrade to this release at their convenience to take advantage of the fixes and addressed CVEs.

Upgrade guidance

Customers who use ServiceProfiles and currently connect to ports on Services that are not defined in the Service spec should add those ports to the corresponding Service spec before upgrading. All other customers can upgrade safely without changes.

See the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.3 or later.

Changelog

Breaking change: Meshed connections to a ClusterIP Service on a port absent from the Service’s spec are now denied even when a ServiceProfile is defined for that Service, matching documentation. [#15473]
Fixed panic in linkerd policy generate command, and add support for proxies injected in (the now default) native sidecar mode.
Update golang to remediate
- GO-2026-5856 (maps to CVE-2026-42505)
- GO-2026-4970 (maps to CVE-2026-39822)
Update golang.org/x/text to remediate
- GO-2026-5970 (maps to CVE-2026-56852)
Update oras.land/oras-go/v2 to remediate
Update google.golang.org/grpc to remediate
- GHSA-hrxh-6v49-42gf
Update opentelemetry to remediate
- GHSA-w9wp-h8wv-79jx
Update libcrypt to remediate
- CVE-2026-6791

enterprise-2.18.12

Thu, 02 Jul 2026 00:00:00 +0000

The 2.18.12 stable point release updates some dependencies to address reported CVEs in underlying components.

FIPS users who are upgrading from 2.18 to 2.19 must follow a specific sequence to preserve zero-downtime upgrades. You must first upgrade to 2.18.7 or later, and then to 2.19.4 or later.

Previous release: enterprise-2.18.11.

Supported Kubernetes versions

For this release, the minimum supported Kubernetes version remains 1.22, and the maximum supported Kubernetes version remains 1.32.

Who should upgrade?

This is a CVE hygiene release and does not fix any known exploitable vulnerabilities with Linkerd. Users may upgrade to this release at their convenience.

Upgrade guidance

This is a stable point release designed to introduce minimal change. Please see the instructions in Upgrading BEL for how to upgrade.

To upgrade with BEL’s lifecycle automation operator, you will need Buoyant Extension v0.40.1 or later.

Changelog

Update golang to remediate
Update golang.org/x/tools to remediate
Update github.com/containerd/containerd dependency to remediate
- GHSA-jpcc-p29g-p8mq
- GHSA-xhf5-7wjv-pqxp
Update libssl3 to remediate