Cilium v1.18.11: StateDB Memory Leak and Gateway API Fixes

The Cilium project released version v1.18.11 on June 16, 2026, delivering critical stability fixes for the internal StateDB engine and refined traffic management for Gateway API implementations. This update is a maintenance release for the 1.18 branch that focuses on resource management and datapath reliability in high scale environments.

The full release notes and downloads are on the GitHub release page.

A significant fix in this release addresses a memory leak within the StateDB transaction logic. StateDB is the internal database used by Cilium to manage state across various components. The issue involved the reuse of a watch channel hash map during very large StateDB transactions. In environments with high churn or large numbers of resources, this leak could lead to steadily increasing memory consumption by the Cilium agent.

The fix, tracked in PR 46498, ensures that watch channels are handled correctly during transaction commits and rollbacks. Operators running large clusters with frequent updates to services or endpoints should see improved memory stability after upgrading. This is particularly relevant for clusters where the Cilium agent has been observed to grow in resident set size over long periods of uptime.

Cilium continues to refine its Gateway API implementation with two important fixes for TLS traffic handling. The first fix addresses weighted backend traffic splitting for TLSRoute passthrough listeners. Previously, the traffic splitter might not have correctly honored the defined weights when operating in passthrough mode. This could result in uneven traffic distribution across backend services despite the configured ratios in the Gateway API manifest.

The second Gateway API fix resolves an issue where TLS passthrough routes would fail silently under specific conditions. This failure occurred when a gateway configuration included a mix of HTTP, HTTPS, and TLS listeners, and a TLSRoute was defined without a specific sectionName. The internal route resolution logic would fail to bind the route correctly, leading to dropped traffic without clear error signals in the logs. These changes, backported in PR 46249 and PR 46234, make the Cilium ingress controller more robust for complex traffic routing scenarios.

The datapath layer received several updates to improve interface management and prevent nil pointer dereferences. One notable change involves how Cilium manages the Maximum Transmission Unit on host interfaces. The agent now utilizes an altname to mark interfaces explicitly owned by Cilium. This prevents the agent from erroneously changing the MTU on interfaces that it does not manage, which could otherwise disrupt host level networking or non Cilium virtual interfaces.

Additionally, a nil pointer dereference was fixed in the filterAndDestroySockets function. This bug could cause agent crashes during socket filtering operations, especially during high connection turnover or when cleanup tasks were running. These datapath fixes contribute to the overall uptime of the network fabric by reducing the risk of unexpected agent restarts.

For operators managing multi cluster environments, this release extends the diagnostic information available through the CLI. The troubleshoot kvstore and clustermesh commands now report more detailed status information. This includes deeper visibility into the health of the key value store and the connectivity state between different clusters in a mesh.

As Clustermesh architectures grow in complexity, having precise data on the synchronization state and reachability of remote nodes becomes essential for fast root cause analysis. The expanded output helps SREs identify split brain scenarios or latency issues in the control plane more effectively.

As this is a patch release in the 1.18 series, it is designed to be a drop in replacement for earlier 1.18.x versions. No schema migrations or breaking API changes are included. Operators should follow standard rolling update procedures for the Cilium agent and operator deployments. Ensure that the Cilium operator is updated alongside the agents to maintain compatibility with the latest StateDB improvements.

The release is available through the following channels: