# Cilium v1.19.7 — 1.19.7

- Product: Cilium (https://whatsnew.fyi/product/cilium)
- Vendor: Cilium
- Date: 2026-08-18
- Version: v1.19.7
- Original notes: https://github.com/cilium/cilium/releases/tag/v1.19.7
- Permalink: https://whatsnew.fyi/product/cilium/releases/v1.19.7

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Restore http-idle-timeout as the route idle timeout source in Envoy
- **fixed** — Fix BPF verifier reject on pre-v5.12 kernels when IPv6 is enabled
- **fixed** — Fix spurious 'unable to find ifindex for interface MAC' agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules
- **fixed** — Fix abnormal IP allocation caused by hostnetwork pod
- **fixed** — Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend and fix ~30-minute NodePort outage after deleting a LoadBalancer with external IP as a node address
- **fixed** — Fix Cilium intercepting traffic towards LoadBalancer VIPs when KPR is disabled
- **fixed** — Fix redirection of egressing traffic within scope of CiliumEgressGatewayPolicy when initial interface is L3
- **fixed** — Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts
- **fixed** — Fix invalid regex on HTTPRoute or GRPCRoute matcher being accepted but causing Envoy to NACK
- **fixed** — Prune SDP identity to IP mapping on delete using newID
- **fixed** — Filter GAMMA Routes correctly before being passed to model ingestion
- **fixed** — Fix CIDR reference counter to use canonical prefixes
- **fixed** — Prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group
- **fixed** — Resolve endpoint manager crash for restored endpoints with verbose policy logging enabled
- **fixed** — Unsubscribe node handler on shutdown in WireGuard

Summary of Changes
------------------

**Bugfixes:**
* envoy: restore http-idle-timeout as the route idle timeout source (Backport PR cilium/cilium#47688, Upstream PR cilium/cilium#47583, @aanm)
* Fix a BPF verifier reject on pre-v5.12 kernels, when IPv6 is enabled. (Backport PR cilium/cilium#47723, Upstream PR cilium/cilium#47765, @julianwiedmann)
* Fix a spurious "unable to find ifindex for interface MAC" agent warning on EKS ENI IPAM by waiting for the ENI netlink interface before configuring ingress routes and rules. (Backport PR cilium/cilium#47545, Upstream PR cilium/cilium#47295, @aanm)
* Fix abnormal ip allocation caused by hostnetwork pod (Backport PR cilium/cilium#47688, Upstream PR cilium/cilium#47552, @haozhangami)
* Fix BPF LB map key collision where HostPort/NodePort expansion could overwrite a LoadBalancer frontend when the node IP matches the LoadBalancer external IP (e.g. k3s/RKE2 L2 ServiceLB). Also fix a ~30-minute NodePort outage that occurred after deleting a LoadBalancer whose external IP was a node address with a port in the NodePort range. (Backport PR cilium/cilium#47414, Upstream PR cilium/cilium#45314, @syedazeez337)
* Fix bug causing Cilium to intercept traffic towards LoadBalancer VIPs when KPR is disabled, when the traffic should be delegated to kube-proxy. (Backport PR cilium/cilium#47414, Upstream PR cilium/cilium#47204, @ajmmm)
* Fix redirection of egressing traffic that falls in scope of a CiliumEgressGatewayPolicy, when the initial interface is a L3 interface. (Backport PR cilium/cilium#47757, Upstream PR cilium/cilium#45703, @julianwiedmann)
* Fix: Cilium Ingress now automatically reallocates ports and retries when cilium-envoy fails to bind due to port conflicts (Backport PR cilium/cilium#47410, Upstream PR cilium/cilium#42859, @inerplat)
* Fixes an issue where invalid regex on an HTTPRoute or GRPCRoute matcher is accepted but causes Envoy to NACK (Backport PR cilium/cilium#47468, Upstream PR cilium/cilium#47005, @0xch4z)
* fqdn/service: prune SDP identity->IP mapping on delete using newID (Backport PR cilium/cilium#47545, Upstream PR cilium/cilium#47100, @vipul-21)
* gateway-api: GAMMA Routes are now filtered correctly before being passed to model ingestion. (Backport PR cilium/cilium#47468, Upstream PR cilium/cilium#45294, @youngnick)
* ipcache: fix CIDR reference counter to use canonical prefixes (Backport PR cilium/cilium#47886, Upstream PR cilium/cilium#47208, @iwanhae)
* lbipam: prevent reassigning Service LoadBalancer IPs on operator restart when the existing IP belongs to a compatible sharing key group. (Backport PR cilium/cilium#46559, Upstream PR cilium/cilium#46262, @ieth0)
* Resolve a endpoint manager crash for restored endpoints with verbose policy logging enabled. (Backport PR cilium/cilium#47886, Upstream PR cilium/cilium#47844, @bimmlerd)
* wireguard: Unsubscribe node handler on shutdown (Backport PR cilium/cilium#47804, Upstream PR cilium/cilium#47614, @HadrienPatte)

**CI Changes:**
* .github: fail smoke IPv6 closed when the test job does not succeed (Backport PR cilium/cilium#47545, Upstream PR cilium/cilium#47441, @aanm)
* .github: retry CLI and binary downloads over transient network errors (Backport PR cilium/cilium#47290, Upstream PR cilium/cilium#47167, @aanm)
* .github: Run envoy image check against PR content (Backport PR cilium/cilium#47886, Upstream PR cilium/cilium#47792, @joestringer)
* .github: Simplify permissions for image linter workflow (Backport PR cilium/cilium#47804, Upstream PR cilium/cilium#47753, @joestringer)
* .github: suppress spurious encryption leak reports for node-to-pod DNS requests going through proxy (Backport PR cilium/cilium#47688, Upstream PR cilium/cilium#47470, @atykhyy)
* [v1.19] ariane: remove reference to the non-existing lint-ariane-config workflow (cilium/cilium#47701, @giorio94)
* ariane: move kind-proxy-embedded and kubespray workflows to /test (Backport PR cilium/cilium#47804, Upstream PR cilium/ciliu

_[Truncated at 4000 characters — full notes: https://github.com/cilium/cilium/releases/tag/v1.19.7]_