# Envoy changelog > A cloud-native high-performance edge and service proxy. - Vendor: CNCF - Category: Infrastructure & DevOps - License: Apache-2.0 - Language: C++ - Official site: https://www.envoyproxy.io - Tracked by: What's New (https://whatsnew.fyi/product/envoy) - Harvested from: GitHub (envoyproxy/envoy) - Entries below: 22 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v1.39.3 - Date: 2026-10-06 - Version: v1.39.3 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.3 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.39.3 - **security** — oauth2: reject requests without a :path header (i.e. CONNECT) with 400 to prevent crash - **security** — api_key_auth: prevent crash when hide_credentials is enabled with a query key source and a request without a :path header is authenticated via another key source **Summary of changes**: * Security fixes: - [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w): oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`. - [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j): api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.3 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.39.3/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.39.3/version_history/v1.39/v1.39.3 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.39.2...v1.39.3 Signed-off-by: wbpcode Signed-off-by: Ryan Northey Signed-off-by: Kateryna Nezdolii ### v1.38.6 - Date: 2026-10-06 - Version: v1.38.6 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.6 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.6 - **security** — oauth2 filter now rejects requests without a :path header (i.e. CONNECT) with 400 to prevent crash - **security** — api_key_auth filter no longer crashes when hide_credentials is enabled with a query key source and a request without a :path header is authenticated via another key source **Summary of changes**: * Security fixes: - [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w): oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`. - [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j): api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.6 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.38.6/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.38.6/version_history/v1.38/v1.38.6 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.38.5...v1.38.6 Signed-off-by: wbpcode Signed-off-by: Ryan Northey Signed-off-by: Kateryna Nezdolii ### v1.37.8 - Date: 2026-10-06 - Version: v1.37.8 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.8 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.37.8 - **security** — oauth2: reject requests without a :path header (i.e. CONNECT) with 400 instead of crashing - **security** — api_key_auth: prevent crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source **Summary of changes**: * Security fixes: - [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w): oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`. - [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j): api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.8 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.37.8/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.37.8/version_history/v1.37/v1.37.8 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.37.7...v1.37.8 Signed-off-by: wbpcode Signed-off-by: Ryan Northey Signed-off-by: Kateryna Nezdolii ### v1.36.12 - Date: 2026-10-06 - Version: v1.36.12 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.12 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.36.12 - **security** — Fix oauth2 filter crash on requests without a :path header (i.e. CONNECT) by rejecting such requests with 400 - **security** — Fix api_key_auth filter crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source **Summary of changes**: * Security fixes: - [GHSA-8vc2-jrm4-835w](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8vc2-jrm4-835w): oauth2: crash on requests without a `:path` header (i.e. CONNECT). The filter now rejects such requests with `400`. - [GHSA-47vj-9r25-wv5j](https://github.com/envoyproxy/envoy/security/advisories/GHSA-47vj-9r25-wv5j): api_key_auth: crash when `hide_credentials` is enabled with a `query` key source and a request without a `:path` header (i.e. CONNECT) is authenticated via another key source. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.12 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.36.12/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.36.12/version_history/v1.36/v1.36.12 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.36.11...v1.36.12 Signed-off-by: wbpcode Signed-off-by: Ryan Northey Signed-off-by: Kateryna Nezdolii ### v1.39.2 - Date: 2026-10-01 - Version: v1.39.2 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.2 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.39.2 - **security** — Update BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes - **removed** — Remove Debian bullseye (11) packaging as it is end-of-life - **changed** — Move Debian .changes and release checksum signing into the Bazel release assembly with an audit of signing actions - **changed** — Refresh Ubuntu build and distroless Docker base images **Summary of changes**: * Security fixes: - [CVE-2026-35189](https://github.com/google/boringssl/blob/main/docs/advisories/2026-09-29.md): tls: updated BoringSSL to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. * Build/packaging: - Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors. - Moved Debian `.changes` and release checksum signing into the Bazel release assembly, with an audit of signing actions. - Refreshed the Ubuntu build and distroless Docker base images. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.2 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.39.2/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.39.2/version_history/v1.39/v1.39.2 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.39.1...v1.39.2 Signed-off-by: Greg Greenway Signed-off-by: Kateryna Nezdolii Signed-off-by: Ryan Northey ### v1.38.5 - Date: 2026-10-01 - Version: v1.38.5 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.5 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.5 - **security** — Patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes - **removed** — Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors - **changed** — Moved Debian .changes and release checksum signing into the Bazel release assembly with an audit of signing actions - **changed** — Refreshed the Ubuntu build image **Summary of changes**: * Security fixes: - [CVE-2026-35189](https://github.com/google/boringssl/blob/main/docs/advisories/2026-09-29.md): tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (`--config=boringssl-fips`) does not receive this patch. * Build/packaging: - Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors. - Moved Debian `.changes` and release checksum signing into the Bazel release assembly, with an audit of signing actions. - Refreshed the Ubuntu build image. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.5 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.38.5/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.5 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.38.4...v1.38.5 Signed-off-by: Greg Greenway Signed-off-by: Kateryna Nezdolii Signed-off-by: Ryan Northey ### v1.37.7 - Date: 2026-10-01 - Version: v1.37.7 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.7 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.37.7 - **security** — Patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes - **removed** — Removed Debian bullseye (11) packaging as bullseye is end-of-life - **changed** — Moved Debian .changes and release checksum signing into the Bazel release assembly with an audit of signing actions - **changed** — Refreshed the Ubuntu build image **Summary of changes**: * Security fixes: - [CVE-2026-35189](https://github.com/google/boringssl/blob/main/docs/advisories/2026-09-29.md): tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (`--define boringssl=fips`) does not receive this patch. * Build/packaging: - Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors. - Moved Debian `.changes` and release checksum signing into the Bazel release assembly, with an audit of signing actions. - Refreshed the Ubuntu build image. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.7 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.37.7/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.37.7/version_history/v1.37/v1.37.7 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.37.6...v1.37.7 Signed-off-by: Greg Greenway Signed-off-by: Kateryna Nezdolii Signed-off-by: Ryan Northey ### v1.36.11 - Date: 2026-10-01 - Version: v1.36.11 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.11 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.36.11 - **security** — Patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes - **removed** — Removed Debian bullseye (11) packaging as it is end-of-life and its repositories are no longer available on the main Debian mirrors **Summary of changes**: * Security fixes: - [CVE-2026-35189](https://github.com/google/boringssl/blob/main/docs/advisories/2026-09-29.md): tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. Note that the FIPS build is not patched. * Build/packaging: - Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.11 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.36.11/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.36.11/version_history/v1.36/v1.36.11 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.36.10...v1.36.11 Signed-off-by: Greg Greenway Signed-off-by: Kateryna Nezdolii Signed-off-by: Ryan Northey ### v1.39.1 - Date: 2026-08-27 - Version: v1.39.1 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.1 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.39.1 - **security** — Strip path parameters from individual path segments per RFC 3986 section 3.3 in URL normalization - **security** — Fix use-after-free on a specifically timed sequence of HTTP/3 frames - **security** — Fix abnormal process termination on trailers received without the END_STREAM flag in HTTP/2 - **security** — Sanitize stat names before converting them to HTML in admin interface - **security** — Fix abnormal process termination in ext_authz on requests without a URI path - **security** — Prevent payload sent before a generic HTTP upgrade from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection - **security** — Fix crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters - **security** — Make dropped Host headers count towards request header map size and count limits in HTTP/2 - **security** — Strip path parameters from dot and dotdot segments in URL normalization to ensure canonicalization interprets them correctly - **security** — Switch safe_regex charset mode from UTF-8 to Latin1 to match HTTP header encoding - **security** — Make RBAC path matching respect the route's ignore_path_parameters_in_path_matching to prevent authz bypass - **security** — Fix use-after-free when ext_authz over HTTP causes a request to be rejected - **security** — Fix abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3 - **fixed** — Fix filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped - **fixed** — Fix multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks - **fixed** — Fix memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call - **fixed** — Fix bug where OpenSSL used glibc's allocator instead of tcmalloc, making OpenSSL allocations invisible to tcmalloc heap profiling **Summary of changes**: * Security fixes: - [CVE-2026-73511](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x): url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with `envoy.reloadable_features.strip_path_parameters_per_segment`. - [CVE-2026-73512](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg): http3: UAF on a specifically timed sequence of HTTP/3 frames. - [CVE-2026-73513](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw): http2: abnormal process termination on trailers received without the END_STREAM flag. - [CVE-2026-73546](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg): admin: sanitize stat names before converting them to HTML. Guarded by `envoy.reloadable_features.sanitize_html_stats_names`. - [CVE-2026-73547](https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r): ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT). - [CVE-2026-73548](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2): http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`. - [CVE-2026-73549](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jp5f-qr64-c9vw): quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. - [CVE-2026-73550](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh): http2: dropped `Host` headers now count towards request header map size and count limits. Revert with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`. - [CVE-2026-73551](https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4): url normalization: strip path parameters from dot and dotdot segments (`/.;`, `/..;`) so canonicalization interprets them correctly. Applies only when `normalize_path` is enabled; revert with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`. - [CVE-2026-73552](https://github.com/envoyproxy/envoy/security/advisories/GHSA-23xh-2qxr-3xv8): safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with `envoy.reloadable_features.re2_use_latin1_mode`. - [CVE-2026-73553](https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq): rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authz bypass via appended path parameters. Revert with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`. - [CVE-2026-50572](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv): ext_authz: UAF when ext_authz over HTTP causes a request to be rejected. - [CVE-2026-48521](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vff-j9p4-38j3): http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3. * Bug fixes: - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via `addDecodedData()`/`addEncodedData()` immediately before returning `Continue` was silently dropped, corrupting large streamed bodies. Revert with `envoy.reloadable_features.filter_manager_forward_added_data_on_continue`. - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks. - tls: fixed a memory leak in the OpenSSL compatibility layer where `SSL_get0_peer_certificates()` leaked an `X509` refcount per call, preventing certificates from being freed on connection close. - tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a s _[Truncated at 4000 characters — full notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.1]_ ### v1.38.4 - Date: 2026-08-26 - Version: v1.38.4 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.4 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.4 - **security** — Strip path parameters from individual path segments per RFC 3986 section 3.3 in url normalization - **security** — Fix UAF on a specifically timed sequence of HTTP/3 frames - **security** — Fix abnormal process termination on trailers received without the END_STREAM flag in HTTP/2 - **security** — Sanitize stat names before converting them to HTML in admin interface - **security** — Fix abnormal process termination on requests without a URI path in ext_authz filter - **security** — Prevent payload sent before a generic HTTP upgrade from being interpreted as a pipelined HTTP/1 request - **security** — Fix crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters - **security** — Count dropped Host headers towards request header map size and count limits in HTTP/2 - **security** — Strip path parameters from dot and dotdot segments in url normalization during canonicalization - **security** — Switch safe_regex charset mode from UTF-8 to Latin1 for HTTP header matching - **security** — Make RBAC path matching respect the route's ignore_path_parameters_in_path_matching setting - **security** — Fix UAF when ext_authz over HTTP causes a request to be rejected - **security** — Fix abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3 - **fixed** — Fix filter manager bug where a body frame moved via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped - **fixed** — Fix multiple lifetime bugs in ext_proc filter and underlying gRPC async client that could lead to use-after-free or double delivery of callbacks - **fixed** — Fix lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is pending - **fixed** — Fix memory leak in OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call - **fixed** — Fix bug where OpenSSL used glibc's allocator instead of tcmalloc, making OpenSSL allocations invisible to tcmalloc heap profiling **Summary of changes**: * Security fixes: - [CVE-2026-73511](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x): url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with `envoy.reloadable_features.strip_path_parameters_per_segment`. - [CVE-2026-73512](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg): http3: UAF on a specifically timed sequence of HTTP/3 frames. - [CVE-2026-73513](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw): http2: abnormal process termination on trailers received without the END_STREAM flag. - [CVE-2026-73546](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg): admin: sanitize stat names before converting them to HTML. Guarded by `envoy.reloadable_features.sanitize_html_stats_names`. - [CVE-2026-73547](https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r): ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT). - [CVE-2026-73548](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2): http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`. - [CVE-2026-73549](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jp5f-qr64-c9vw): quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. - [CVE-2026-73550](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh): http2: dropped `Host` headers now count towards request header map size and count limits. Revert with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`. - [CVE-2026-73551](https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4): url normalization: strip path parameters from dot and dotdot segments (`/.;`, `/..;`) so canonicalization interprets them correctly. Applies only when `normalize_path` is enabled; revert with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`. - [CVE-2026-73552](https://github.com/envoyproxy/envoy/security/advisories/GHSA-23xh-2qxr-3xv8): safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with `envoy.reloadable_features.re2_use_latin1_mode`. - [CVE-2026-73553](https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq): rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authz bypass via appended path parameters. Revert with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`. - [CVE-2026-50572](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv): ext_authz: UAF when ext_authz over HTTP causes a request to be rejected. - [CVE-2026-48521](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vff-j9p4-38j3): http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3. * Bug fixes: - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via `addDecodedData()`/`addEncodedData()` immediately before returning `Continue` was silently dropped, corrupting large streamed bodies. Revert with `envoy.reloadable_features.filter_manager_forward_added_data_on_continue`. - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks. - router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending. - tls: fixed a memory leak in the OpenSSL compatibility layer where `SSL_get0_peer_certificates()` leaked an `X509` refcount per call, preventing certific _[Truncated at 4000 characters — full notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.4]_ ### v1.37.6 - Date: 2026-08-26 - Version: v1.37.6 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.6 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.37.6 - **security** — Strip path parameters from individual path segments per RFC 3986 section 3.3 in URL normalization, revertible with envoy.reloadable_features.strip_path_parameters_per_segment - **security** — Fix use-after-free on a specifically timed sequence of HTTP/3 frames - **security** — Fix abnormal process termination on HTTP/2 trailers received without the END_STREAM flag - **security** — Sanitize stat names before converting them to HTML in admin interface, guarded by envoy.reloadable_features.sanitize_html_stats_names - **security** — Fix abnormal process termination in ext_authz on requests without a URI path such as CONNECT - **security** — Prevent payload sent before a generic HTTP upgrade from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection, revertible with envoy.reloadable_features.http_pause_generic_upgrade_request_body - **security** — Fix crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters - **security** — Count dropped Host headers towards request header map size and count limits in HTTP/2, revertible with envoy.reloadable_features.http2_track_size_of_dropped_host_header - **security** — Strip path parameters from dot and dotdot segments in URL normalization so canonicalization interprets them correctly, applies only when normalize_path is enabled, revertible with envoy.reloadable_features.strip_dotdot_segments_with_parameters - **security** — Switch safe_regex charset mode from UTF-8 to Latin1 as HTTP headers are not UTF-8 encoded, revertible with envoy.reloadable_features.re2_use_latin1_mode - **security** — RBAC path matching now respects the route's ignore_path_parameters_in_path_matching to prevent authz bypass via appended path parameters, revertible with envoy.reloadable_features.rbac_respect_ignore_path_parameters - **security** — Fix use-after-free in ext_authz when ext_authz over HTTP causes a request to be rejected - **security** — Fix abnormal process termination in HTTP/3 when upstream protocol is selected via ALPN and the server uses HTTP/3 - **fixed** — Fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies, revertible with envoy.reloadable_features.filter_manager_forward_added_data_on_continue - **fixed** — Fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks - **fixed** — Fixed a bug where unnecessary empty data chunks were processed by the ext_proc filter chain, revertible with envoy.reloadable_features.ext_proc_return_stop_iteration - **fixed** — Fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending **Summary of changes**: * Security fixes: - [CVE-2026-73511](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x): url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with `envoy.reloadable_features.strip_path_parameters_per_segment`. - [CVE-2026-73512](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg): http3: UAF on a specifically timed sequence of HTTP/3 frames. - [CVE-2026-73513](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw): http2: abnormal process termination on trailers received without the END_STREAM flag. - [CVE-2026-73546](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg): admin: sanitize stat names before converting them to HTML. Guarded by `envoy.reloadable_features.sanitize_html_stats_names`. - [CVE-2026-73547](https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r): ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT). - [CVE-2026-73548](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2): http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`. - [CVE-2026-73549](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jp5f-qr64-c9vw): quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. - [CVE-2026-73550](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh): http2: dropped `Host` headers now count towards request header map size and count limits. Revert with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`. - [CVE-2026-73551](https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4): url normalization: strip path parameters from dot and dotdot segments (`/.;`, `/..;`) so canonicalization interprets them correctly. Applies only when `normalize_path` is enabled; revert with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`. - [CVE-2026-73552](https://github.com/envoyproxy/envoy/security/advisories/GHSA-23xh-2qxr-3xv8): safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with `envoy.reloadable_features.re2_use_latin1_mode`. - [CVE-2026-73553](https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq): rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authz bypass via appended path parameters. Revert with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`. - [CVE-2026-50572](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv): ext_authz: UAF when ext_authz over HTTP causes a request to be rejected. - [CVE-2026-48521](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vff-j9p4-38j3): http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3. * Bug fixes: - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via `addDecodedData()`/`addEncodedData()` immediately before returning `Continue` was silently dropped, corrupting large streamed bodies. Revert with `envoy.reloadable_features.filter_manager_forward_added_data_on_continue`. - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks. - ext_proc: fixed a bug where unnecessary empty data chunks were processed by the filter chain. Revert with `envoy.reloadable_features.ext_proc_return_stop_iteration`. - router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is s _[Truncated at 4000 characters — full notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.6]_ ### v1.36.10 - Date: 2026-08-26 - Version: v1.36.10 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.10 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.36.10 - **security** — Strip path parameters from individual path segments per RFC 3986 section 3.3 in URL normalization - **security** — Fix use-after-free on a specifically timed sequence of HTTP/3 frames - **security** — Fix abnormal process termination on trailers received without the END_STREAM flag in HTTP/2 - **security** — Sanitize stat names before converting them to HTML in admin interface - **security** — Fix abnormal process termination on requests without a URI path in ext_authz - **security** — Prevent payload sent before a generic HTTP upgrade from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection - **security** — Fix crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters - **security** — Count dropped Host headers towards request header map size and count limits in HTTP/2 - **security** — Strip path parameters from dot and dotdot segments in URL normalization for correct canonicalization - **security** — Switch safe_regex charset mode from UTF-8 to Latin1 for proper HTTP header matching - **security** — Make RBAC path matching respect the route's ignore_path_parameters_in_path_matching to prevent authz bypass - **security** — Fix use-after-free when ext_authz over HTTP causes a request to be rejected - **security** — Fix abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3 - **fixed** — Fix filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData() or addEncodedData() immediately before returning Continue was silently dropped - **fixed** — Fix multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks - **fixed** — Fix a bug to support two ext_proc filters configured in the chain - **fixed** — Fix lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending **Summary of changes**: * Security fixes: - [CVE-2026-73511](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m745-gh6x-349x): url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with `envoy.reloadable_features.strip_path_parameters_per_segment`. - [CVE-2026-73512](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r6j2-mrm5-72mg): http3: UAF on a specifically timed sequence of HTTP/3 frames. - [CVE-2026-73513](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jjmm-fw8p-crpw): http2: abnormal process termination on trailers received without the END_STREAM flag. - [CVE-2026-73546](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg): admin: sanitize stat names before converting them to HTML. Guarded by `envoy.reloadable_features.sanitize_html_stats_names`. - [CVE-2026-73547](https://github.com/envoyproxy/envoy/security/advisories/GHSA-87ph-jqwm-pg6r): ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT). - [CVE-2026-73548](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2): http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`. - [CVE-2026-73549](https://github.com/envoyproxy/envoy/security/advisories/GHSA-jp5f-qr64-c9vw): quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. - [CVE-2026-73550](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qgf6-qvhw-4hvh): http2: dropped `Host` headers now count towards request header map size and count limits. Revert with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`. - [CVE-2026-73551](https://github.com/envoyproxy/envoy/security/advisories/GHSA-2w8w-rfw7-8gg4): url normalization: strip path parameters from dot and dotdot segments (`/.;`, `/..;`) so canonicalization interprets them correctly. Applies only when `normalize_path` is enabled; revert with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`. - [CVE-2026-73552](https://github.com/envoyproxy/envoy/security/advisories/GHSA-23xh-2qxr-3xv8): safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with `envoy.reloadable_features.re2_use_latin1_mode`. - [CVE-2026-73553](https://github.com/envoyproxy/envoy/security/advisories/GHSA-77x5-xqjg-hprq): rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authz bypass via appended path parameters. Revert with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`. - [CVE-2026-50572](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q8wp-gf7q-m8cv): ext_authz: UAF when ext_authz over HTTP causes a request to be rejected. - [CVE-2026-48521](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vff-j9p4-38j3): http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3. * Bug fixes: - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via `addDecodedData()`/`addEncodedData()` immediately before returning `Continue` was silently dropped, corrupting large streamed bodies. Revert with `envoy.reloadable_features.filter_manager_forward_added_data_on_continue`. - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks. - ext_proc: fixed a bug to support two ext_proc filters configured in the chain. Revert with `envoy.reloadable_features.ext_proc_inject_data_with_state_update`. - router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pe _[Truncated at 4000 characters — full notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.10]_ ### v1.39.0 - Date: 2026-07-14 - Version: v1.39.0 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.0 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.39.0 - **changed** — Envoy now uses Bazel 8, requiring --enable_workspace and --noenable_bzlmod flags in .bazelrc - **removed** — Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled for all builds due to a broken source archive - **deprecated** — enforce_rsa_key_usage is deprecated and ignored; Envoy now always enforces the certificate keyUsage extension - **changed** — TLS inspector validates client TLS versions to be between TLS 1.0 and TLS 1.3 - **changed** — OpenTelemetry tracer now honors Envoy's request-entry sampling decision including overall_sampling, which may reduce exported spans - **security** — HTTP/2 now counts uncompressed cookies toward header-size and header-count limits (CVE-2026-47774) and strengthens PRIORITY/WINDOW_UPDATE flood protection - **security** — HTTP/2 adds configurable nghttp2 RST_STREAM rate limits - **security** — HTTP/3 fixes QPACK blocked-decoding denial of service (GHSA-p7c7-7c47-pwch) - **security** — HTTP/3 fixes inconsistent headers-only content-length handling (CVE-2026-48743) - **security** — Added security fixes for ext_authz (CVE-2026-47205), ext_proc (CVE-2026-47207), gRPC stats (CVE-2026-47204), internal redirects (CVE-2026-47221), and OAuth2 lifecycle handling (CVE-2026-48090) - **security** — OAuth2 adds AES-256-GCM cookie encryption to address CVE-2026-47775 with opt-in migration via oauth2_use_gcm_encryption flag - **security** — Fixed DNS query validation (CVE-2026-48497), JSON nesting limits (CVE-2026-48042), PROXY protocol TLV smuggling (CVE-2026-47692), formatter crashes (CVE-2026-47220), TCP StatsD overflow (CVE-2026-48706), TLS SAN NUL handling (CVE-2026-47778), and Zstd decompression memory exhaustion (CVE-2026-48044) - **added** — New upstream RBAC and dynamic-forward-proxy resolved-address filtering provide CIDR-based protection against SSRF after DNS resolution - **added** — Dynamic modules gain new extension points for access-log/header formatters, downstream and upstream transport sockets, active health checkers, and stats sinks - **added** — Cluster load balancers can read host stats, read and write dynamic metadata and filter state, and publish main-thread state to worker-local slots - **added** — Dynamic modules can emit metrics from configuration and background contexts with server-wide counters tagged by extension instance - **added** — Wuffs-backed streaming JSON parser added for MCP, A2A, OpenAI, Anthropic, and related protocols with bounded field capture and duplicate-key detection - **added** — New HTTP filters provide weighted bandwidth sharing and selectable sub-filter chains with per-route configuration ##### Summary of changes ##### Breaking changes - **build**: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, `--enable_workspace` and `--noenable_bzlmod` are required and have been added to `.bazelrc`; external-repository runfiles now appear directly under the runfiles root. - **build**: the Intel DLB connection balancer (`envoy.network.connection_balance.dlb`) is disabled for all builds due to a broken source archive. - **TLS**: `enforce_rsa_key_usage` is deprecated and ignored; Envoy now always enforces the certificate `keyUsage` extension. - **TLS inspector**: client TLS versions are validated and must be between TLS 1.0 and TLS 1.3 (revertible via `envoy.reloadable_features.tls_inspector_enforce_client_tls_version`). - **OpenTelemetry tracing**: the tracer now honors Envoy's request-entry sampling decision, including `overall_sampling`, even when propagated trace context or the configured sampler requests sampling. This may reduce exported spans. ###### Security - HTTP/2 now counts uncompressed cookies toward header-size and header-count limits (**CVE-2026-47774**), strengthens PRIORITY/WINDOW_UPDATE flood protection, and adds configurable nghttp2 RST_STREAM rate limits. - HTTP/3 fixes cover QPACK blocked-decoding denial of service (**GHSA-p7c7-7c47-pwch**) and inconsistent headers-only `content-length` handling (**CVE-2026-48743**). - Security fixes were added for ext_authz (**CVE-2026-47205**), ext_proc (**CVE-2026-47207**), gRPC stats (**CVE-2026-47204**), internal redirects (**CVE-2026-47221**), and OAuth2 lifecycle handling (**CVE-2026-48090**). - OAuth2 adds AES-256-GCM cookie encryption to address **CVE-2026-47775**. Migration is opt-in: enable `oauth2_use_gcm_encryption`, monitor `oauth_legacy_cbc_decrypt`, then disable `oauth2_legacy_cbc_decrypt_compat`. - Additional fixes cover DNS query validation (**CVE-2026-48497**), JSON nesting limits (**CVE-2026-48042**), PROXY protocol TLV smuggling (**CVE-2026-47692**), formatter crashes (**CVE-2026-47220**), TCP StatsD overflow (**CVE-2026-48706**), TLS SAN NUL handling (**CVE-2026-47778**), and Zstd decompression memory exhaustion (**CVE-2026-48044**). - New upstream RBAC and dynamic-forward-proxy resolved-address filtering provide CIDR-based protection against SSRF after DNS resolution and host selection. ###### Dynamic modules - New extension points: access-log/header formatters, downstream and upstream transport sockets, active health checkers, and stats sinks. - Cluster load balancers can read host stats, read and write dynamic metadata and filter state, and publish main-thread state to worker-local slots. - Modules can emit metrics from configuration and background contexts; loading and initialization failures now expose server-wide counters tagged by extension instance. - Added validation-mode detection, network/listener attribute access, batched header and metadata APIs, effective log-level access, and zero-copy borrowed buffers in the Rust SDK. - Fixed listener HTTP-callout crashes, watermark initialization, streaming-response re-entry, independent decode/encode continuation, CatchUnwind re-entry, `Struct` configuration handling, and HTTP/TCP bridge buffer overflow with more than 64 slices. ###### MCP (Model Context Protocol) and AI protocols - Added a Wuffs-backed streaming JSON parser for MCP, A2A, OpenAI, Anthropic, and related protocols, with bounded field capture, incremental parsing, no DOM allocation, and duplicate-key detection. - MCP filtering now exposes processing status, supports configurable duplicate-key rejection, and improves oversized-body behavior for pass-through and rejection modes. - MCP router adds elicitation and server-to-client request routing, plus lazy per-backend initialization. - MCP JSON REST Bridge adds per-route tool configuration and locally generated `tools/list` responses. ###### HTTP, routing and protocol - New HTTP filters provide weighted bandwidth sharing and selectable _[Truncated at 4000 characters — full notes: https://github.com/envoyproxy/envoy/releases/tag/v1.39.0]_ ### v1.38.3 - Date: 2026-06-23 - Version: v1.38.3 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.3 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.3 - **security** — Fixed authz per route crash - **security** — Fixed ext_proc response in one gRPC message - **security** — Fixed router internal redirects crash - **security** — Fixed REQUESTED_SERVER_NAME crash - **security** — Fixed OAuth2 code verifier padding oracle - **security** — Fixed zstd RLE zip bomb - **security** — Fixed grpc_stats filter segfault on Connect protocol requests to direct_response routes - **security** — Fixed PROXY Protocol v2 header generator emits skipped TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream - **security** — Fixed embedded NUL in TLS SAN truncation, auth bypass - **security** — Fixed stack overflow in destructor of highly nested JSON - **security** — Fixed OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - **security** — Fixed abnormal process termination in DNS UDP filter - **security** — Fixed HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length - **security** — Fixed Envoy heap buffer overflow in TcpStatsdSink - **security** — Fixed denial-of-service attack against the HTTP/3 stack via QPACK blocked decoding - **security** — Bumped com_github_wasmtime to resolve CVE-2026-47261 - **removed** — Disabled the contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) at the Bazel layer for all builds and platforms - **changed** — Disabled runtime guard envoy.reloadable_features.tls_certificate_compression_brotli by default, retaining zlib-only certificate compression for QUIC and disabling certificate compression for TCP TLS **Summary of changes**: * Security fixes: - [CVE-2026-47205](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mvh9-767w-x47j): Authz per route crash - [CVE-2026-47207](https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv): ext_proc response in one gRPC message - [CVE-2026-47221](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr): router internal redirects crash - [CVE-2026-47220](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v): REQUESTED_SERVER_NAME crash - [CVE-2026-47775](https://github.com/envoyproxy/envoy/security/advisories/GHSA-396h-jpq4-vc7p): OAuth2 code verifier padding oracle - [CVE-2026-48044](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg): zstd RLE zip bomb - [CVE-2026-47204](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6): grpc_stats filter segfault on Connect protocol requests to direct_response routes - [CVE-2026-47692](https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r): PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream - [CVE-2026-47778](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7): Embedded NUL in TLS SAN Truncation, Auth Bypass - [CVE-2026-48042](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv): Stack overflow in destructor of highly nested JSON - [CVE-2026-48090](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f): OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - [CVE-2026-48497](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q): Abnormal process termination in DNS UDP filter - [CVE-2026-48743](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf): HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length - [CVE-2026-48706](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4): Envoy Heap Buffer Overflow in TcpStatsdSink - [GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch): Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding * Upstream security fixes: - CVE-2026-47261: wasm: bumped ``com_github_wasmtime`` to resolve CVE-2026-47261. * Behavior changes: - build: disabled the contrib extension ``envoy.network.connection_balance.dlb`` (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive. See https://github.com/envoyproxy/envoy/issues/45491 for local workarounds. * Minor behavior changes: - tls: runtime guard ``envoy.reloadable_features.tls_certificate_compression_brotli`` is now disabled by default. When disabled, QUIC retains zlib-only certificate compression and TCP TLS performs no certificate compression. It can be re-enabled by setting the runtime guard to ``true``. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.3 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.38.3/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.38.3/version_history/v1.38/v1.38.3 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.38.2...v1.38.3 Signed-off-by: Greg Greenway Signed-off-by: Jonh Wendell Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Boteng Yao [boteng@google.com](mailto:boteng@google.com) ### v1.37.5 - Date: 2026-06-23 - Version: v1.37.5 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.5 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.37.5 - **security** — Fixed authz per route crash - **security** — Fixed ext_proc response in one gRPC message - **security** — Fixed router internal redirects crash - **security** — Fixed REQUESTED_SERVER_NAME crash - **security** — Fixed OAuth2 code verifier padding oracle - **security** — Fixed zstd RLE zip bomb - **security** — Fixed grpc_stats filter segfault on Connect protocol requests to direct_response routes - **security** — Fixed PROXY Protocol v2 header generator emitting skipped TLVs causing 65 KB attacker-controlled spillover into the upstream application stream - **security** — Fixed embedded NUL in TLS SAN truncation auth bypass - **security** — Fixed stack overflow in destructor of highly nested JSON - **security** — Fixed OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - **security** — Fixed abnormal process termination in DNS UDP filter - **security** — Fixed HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length - **security** — Fixed heap buffer overflow in TcpStatsdSink - **security** — Fixed denial-of-service attack against the HTTP/3 stack via QPACK blocked decoding - **security** — Bumped com_github_wasmtime to resolve CVE-2026-47261 - **changed** — Disabled the contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) at the Bazel layer for all builds and platforms **Summary of changes**: * Security fixes: - [CVE-2026-47205](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mvh9-767w-x47j):Authz per route crash - [CVE-2026-47207](https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv): ext_proc response in one gRPC message - [CVE-2026-47221](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr): router internal redirects crash - [CVE-2026-47220](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j9wh-4qfm-wf2v): REQUESTED_SERVER_NAME crash - [CVE-2026-47775](https://github.com/envoyproxy/envoy/security/advisories/GHSA-396h-jpq4-vc7p): OAuth2 code verifier padding oracle - [CVE-2026-48044](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg): zstd RLE zip bomb - [CVE-2026-47204](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6): grpc_stats filter segfault on Connect protocol requests to direct_response routes - [CVE-2026-47692](https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r): PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream - [CVE-2026-47778](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7): Embedded NUL in TLS SAN Truncation, Auth Bypass - [CVE-2026-48042](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv): Stack overflow in destructor of highly nested JSON - [CVE-2026-48090](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f): OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - [CVE-2026-48497](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q): Abnormal process termination in DNS UDP filter - [CVE-2026-48743](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf): HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length - [CVE-2026-48706](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4): Envoy Heap Buffer Overflow in TcpStatsdSink - [GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch): Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding * Upstream security fixes: - CVE-2026-47261: wasm: bumped ``com_github_wasmtime`` to resolve CVE-2026-47261. * Behavior changes: - build: disabled the contrib extension ``envoy.network.connection_balance.dlb`` (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive. See https://github.com/envoyproxy/envoy/issues/45491 for local workarounds. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.5 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.37.5/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.37.5/version_history/v1.37/v1.37.5 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.37.4...v1.37.5 Signed-off-by: Greg Greenway Signed-off-by: Jonh Wendell Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Boteng Yao [boteng@google.com](mailto:boteng@google.com) ### v1.36.9 - Date: 2026-06-23 - Version: v1.36.9 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.9 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.36.9 - **security** — Fixed authz per route crash (CVE-2026-47205) - **security** — Fixed ext_proc response in one gRPC message (CVE-2026-47207) - **security** — Fixed router internal redirects crash (CVE-2026-47221) - **security** — Fixed OAuth2 code verifier padding oracle (CVE-2026-47775) - **security** — Fixed zstd RLE zip bomb (CVE-2026-48044) - **security** — Fixed grpc_stats filter segfault on Connect protocol requests to direct_response routes (CVE-2026-47204) - **security** — Fixed PROXY Protocol v2 header generator emitting skipped TLVs causing attacker-controlled spillover into upstream application stream (CVE-2026-47692) - **security** — Fixed embedded NUL in TLS SAN truncation and auth bypass (CVE-2026-47778) - **security** — Fixed stack overflow in destructor of highly nested JSON (CVE-2026-48042) - **security** — Fixed OAuth2 filter late async token completion after stream teardown resulting in use-after-free or crash risk (CVE-2026-48090) - **security** — Fixed abnormal process termination in DNS UDP filter (CVE-2026-48497) - **security** — Fixed HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length (CVE-2026-48743) - **security** — Fixed heap buffer overflow in TcpStatsdSink (CVE-2026-48706) - **security** — Fixed denial-of-service attack against HTTP/3 stack via QPACK blocked decoding (GHSA-p7c7-7c47-pwch) - **security** — Bumped com_github_wasmtime to resolve CVE-2026-47261 - **changed** — Disabled the contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive **Summary of changes**: * Security fixes: - [CVE-2026-47205](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mvh9-767w-x47j):Authz per route crash - [CVE-2026-47207](https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv): ext_proc response in one gRPC message - [CVE-2026-47221](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr): router internal redirects crash - [CVE-2026-47775](https://github.com/envoyproxy/envoy/security/advisories/GHSA-396h-jpq4-vc7p): OAuth2 code verifier padding oracle - [CVE-2026-48044](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg): zstd RLE zip bomb - [CVE-2026-47204](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6): grpc_stats filter segfault on Connect protocol requests to direct_response routes - [CVE-2026-47692](https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r): PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream - [CVE-2026-47778](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7): Embedded NUL in TLS SAN Truncation, Auth Bypass - [CVE-2026-48042](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv): Stack overflow in destructor of highly nested JSON - [CVE-2026-48090](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f): OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - [CVE-2026-48497](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q): Abnormal process termination in DNS UDP filter - [CVE-2026-48743](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf): HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length - [CVE-2026-48706](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4): Envoy Heap Buffer Overflow in TcpStatsdSink - [GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch): Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding * Upstream security fixes: - CVE-2026-47261: wasm: bumped `com_github_wasmtime` to resolve CVE-2026-47261. * Behavior changes: - build: disabled the contrib extension `envoy.network.connection_balance.dlb` (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive. See https://github.com/envoyproxy/envoy/issues/45491 for local workarounds. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.9 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.36.9/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.36.9/version_history/v1.36/v1.36.9 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.36.8...v1.36.9 Signed-off-by: Greg Greenway Signed-off-by: Jonh Wendell Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Boteng Yao [boteng@google.com](mailto:boteng@google.com) ### v1.35.13 - Date: 2026-06-23 - Version: v1.35.13 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.35.13 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.35.13 - **security** — Fixed ext_proc response handling in single gRPC message - **security** — Fixed router internal redirects crash - **security** — Fixed OAuth2 code verifier padding oracle vulnerability - **security** — Fixed zstd RLE zip bomb vulnerability - **security** — Fixed grpc_stats filter segfault on Connect protocol requests to direct_response routes - **security** — Fixed PROXY Protocol v2 header generator emitting skipped TLVs causing upstream application stream spillover - **security** — Fixed embedded NUL in TLS SAN truncation auth bypass - **security** — Fixed stack overflow in destructor of highly nested JSON - **security** — Fixed OAuth2 filter late async token completion after stream teardown resulting in UAF/crash risk - **security** — Fixed DNS filter abnormal process termination on long query name - **security** — Fixed HTTP/3 headers-only request/response content-length validation - **security** — Fixed TcpStatsdSync buffer overflow with large stats name - **security** — Fixed denial-of-service attack against HTTP/3 stack via QPACK blocked decoding - **security** — Bumped com_github_wasmtime to resolve CVE-2026-47261 - **changed** — Disabled the contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to source archive breakage **Summary of changes**: * Security fixes: - [CVE-2026-47207](https://github.com/envoyproxy/envoy/security/advisories/GHSA-68cv-hq5f-g6xv): ext_proc response in one gRPC message - [CVE-2026-47221](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rcff-gw58-pjpr): router internal redirects crash - [CVE-2026-47775](https://github.com/envoyproxy/envoy/security/advisories/GHSA-396h-jpq4-vc7p): OAuth2 code verifier padding oracle - [CVE-2026-48044](https://github.com/envoyproxy/envoy/security/advisories/GHSA-m3p9-47wh-88wg): zstd RLE zip bomb - [CVE-2026-47204](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3jxh-8p6x-7pf6): grpc_stats filter segfault on Connect protocol requests to direct_response routes - [CVE-2026-47692](https://github.com/envoyproxy/envoy/security/advisories/GHSA-wh36-hm39-mm3r): PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream - [CVE-2026-47778](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f8x4-rw5x-f3r7): Embedded NUL in TLS SAN Truncation, Auth Bypass - [CVE-2026-48042](https://github.com/envoyproxy/envoy/security/advisories/GHSA-f24p-rxw2-g6pv): Stack overflow in destructor of highly nested JSON - [CVE-2026-48090](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cj2-c63f-q26f): OAuth2 filter late async token completion after stream teardown results in UAF/crash risk - [CVE-2026-48497](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j6g2-wf95-q66q): DNS filter abnormal process termination on long query name - [CVE-2026-48743](https://github.com/envoyproxy/envoy/security/advisories/GHSA-8phg-2h2q-jgxf): HTTP/3 headers-only request/response content-length not validated - [CVE-2026-48706](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7q3f-gwg7-j8g4): TcpStatsdSync buffer overflow with large stats name - [GHSA-p7c7-7c47-pwch](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p7c7-7c47-pwch): Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding * Upstream security fixes: - CVE-2026-47261: wasm: bumped `com_github_wasmtime` to resolve CVE-2026-47261. * Behavior changes: - build: disabled the contrib extension `envoy.network.connection_balance.dlb` (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive. See https://github.com/envoyproxy/envoy/issues/45491 for local workarounds. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.35.13 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.35.13/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.35.13/version_history/v1.35/v1.35.13 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.35.12...v1.35.13 Signed-off-by: Greg Greenway Signed-off-by: Jonh Wendell Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Boteng Yao [boteng@google.com](mailto:boteng@google.com) ### v1.38.2 - Date: 2026-06-10 - Version: v1.38.2 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.2 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.2 - **fixed** — Fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value - **added** — Added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled cookie header length, and individual cookie header count, enabled with envoy.reloadable_features.http2_record_histograms - **added** — Added envoy.reloadable_features.http2_max_cookies_size_in_kb to limit the size of the reassembled cookie header **Summary of changes**: * Bug fixes: - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value. * New features: - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release. - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.2 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.38.2/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.38.2/version_history/v1.38/v1.38.2 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.38.1...v1.38.2 Signed-off-by: Ryan Northey Signed-off-by: Kateryna Nezdolii ### v1.37.4 - Date: 2026-06-10 - Version: v1.37.4 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.37.4 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.37.4 - **fixed** — Fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value - **added** — Added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled cookie header length, and individual cookie header count, enabled with envoy.reloadable_features.http2_record_histograms - **added** — Added envoy.reloadable_features.http2_max_cookies_size_in_kb to limit the size of the reassembled cookie header **Summary of changes**: * Bug fixes: - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value. * New features: - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release. - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.4 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.37.4/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.37.4/version_history/v1.37/v1.37.4 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.37.3...v1.37.4 Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) ### v1.36.8 - Date: 2026-06-10 - Version: v1.36.8 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.36.8 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.36.8 - **fixed** — Fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value - **added** — Added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled cookie header length, and individual cookie header count, enabled with envoy.reloadable_features.http2_record_histograms - **added** — Added envoy.reloadable_features.http2_max_cookies_size_in_kb to limit the size of the reassembled cookie header **Summary of changes**: * Bug fixes: - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value. * New features: - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release. - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.8 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.36.8/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.36.8/version_history/v1.36/v1.36.8 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.36.7...v1.36.8 Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) ### v1.35.12 - Date: 2026-06-10 - Version: v1.35.12 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.35.12 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.35.12 - **fixed** — Fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value - **added** — Added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled cookie header length, and individual cookie header count, enabled with envoy.reloadable_features.http2_record_histograms - **added** — Added envoy.reloadable_features.http2_max_cookies_size_in_kb to limit the size of the reassembled cookie header **Summary of changes**: * Bug fixes: - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value. * New features: - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release. - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.35.12 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.35.12/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.35.12/version_history/v1.35/v1.35.12 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.35.11...v1.35.12 Signed-off-by: Ryan Northey [ryan@synca.io](mailto:ryan@synca.io) Signed-off-by: Kateryna Nezdolii [kateryna.nezdolii@gmail.com](mailto:kateryna.nezdolii@gmail.com) ### v1.38.1 - Date: 2026-06-04 - Version: v1.38.1 - Original notes: https://github.com/envoyproxy/envoy/releases/tag/v1.38.1 - Permalink: https://whatsnew.fyi/product/envoy/releases/v1.38.1 - **security** — HTTP/2 streams are now reset if they violate the configured maximum header list size, and uncompressed cookies now count towards mutable_max_request_headers_kb and max_headers_count limits to protect against HPACK cookie-bomb attacks - **security** — Fixed a timing side-channel in oauth2 HMAC verification that could leak HMAC secret validity - **security** — Fixed a crash in oauth2 where AES-CBC decryption of token cookies could spuriously succeed on a secret mismatch, tripping a HeaderString validation assert - **security** — Applied nghttp2 CVE-2026-27135 patch for HTTP/2 - **fixed** — Fixed a crash in the HTTP filter when a stream was already above the downstream write-buffer high watermark at filter-chain construction time - **changed** — The upstream transport failure reason is no longer included in the HTTP response body sent to downstream clients, but remains available in access logs - **changed** — Load balancer rebuild coalescing during EDS batch host updates is now opt-in **Summary of changes**: * Security fixes: - [CVE-2026-47774](https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8): http2: HTTP/2 streams are now reset if they violate the configured maximum header list size. Uncompressed cookies now count towards ``mutable_max_request_headers_kb`` and ``max_headers_count`` limits, protecting against an HPACK cookie-bomb that could cause excessive memory usage. This can be reverted with ``envoy.reloadable_features.http2_include_cookies_in_limits``. - oauth2: fixed a timing side-channel in HMAC verification that could leak HMAC secret validity. - oauth2: fixed a crash where AES-CBC decryption of token cookies could spuriously succeed (~1/256) on a secret mismatch, tripping a ``HeaderString`` validation assert. - CVE-2026-27135: http2: applied nghttp2 CVE-2026-27135 patch. * Bug fixes: - dynamic_modules: fixed a crash in the HTTP filter when a stream was already above the downstream write-buffer high watermark at filter-chain construction time. * Minor behavior changes: - router: the upstream transport failure reason is no longer included in the HTTP response body sent to downstream clients (still available in access logs via ``%UPSTREAM_TRANSPORT_FAILURE_REASON%``). Revert with ``envoy.reloadable_features.hide_transport_failure_reason_in_response_body``. - upstream: load balancer rebuild coalescing during EDS batch host updates is now opt-in. Re-enable with ``envoy.reloadable_features.coalesce_lb_rebuilds_on_batch_update``. **Docker images**: https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.1 **Docs**: https://www.envoyproxy.io/docs/envoy/v1.38.1/ **Release notes**: https://www.envoyproxy.io/docs/envoy/v1.38.1/version_history/v1.38/v1.38.1 **Full changelog**: https://github.com/envoyproxy/envoy/compare/v1.38.0...v1.38.1 Signed-off-by: Jonh Wendell Signed-off-by: Greg Greenway Signed-off-by: Ryan Northey