Summary of changes Breaking changes build: Envoy has switched from WORKSPACE to bzlmod. The WORKSPACE file is removed; Envoy, the API and the docs are published as Bazel modules (envoy, envoy_api, envoy-docs). Downstreams must migrate to MODULE.bazel and must add Envoy's custom registry (https://raw.githubusercontent.com/envoyproxy/bazel-registry) alongside the BCR — many of Envoy's dependencies a…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: release: updated the distroless docker image base to pick up the patched ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the compromised eMudhra intermediate CAs. The distroless image released in 1.40.1 still shipped the unpatched bundle. Docker images: https://hub.docker.com/r/envoypro…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: release: updated the distroless docker image base to pick up the patched ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the compromised eMudhra intermediate CAs. The distroless image released in 1.39.5 still shipped the unpatched bundle. Docker images: https://hub.docker.com/r/envoypro…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: release: the distroless docker image now uses the patched ca-certificates package (20250419~deb12u2) from Debian bookworm, so it no longer trusts the roots of the compromised eMudhra intermediate CAs. The distroless image released in 1.38.8 still shipped the unpatched bundle. Docker images: https://hub.docker.com/r/en…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: release: the distroless docker image now uses the patched ca-certificates package (20250419~deb12u2) from Debian bookworm, so it no longer trusts the roots of the compromised eMudhra intermediate CAs. The distroless image released in 1.37.10 still shipped the unpatched bundle. Docker images: https://hub.docker.com/r/e…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: the private keys of several eMudhra intermediate CA certificates were compromised. release: updated the Envoy docker images so they no longer trust the compromised eMudhra CAs. mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Serve…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: the private keys of several eMudhra intermediate CA certificates were compromised. release: updated the Envoy docker images so they no longer trust the compromised eMudhra CAs. mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Serve…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: the private keys of several eMudhra intermediate CA certificates were compromised. release: updated the Envoy docker images so they no longer trust the compromised eMudhra CAs. mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Serve…
Summary of changes: Upstream security fixes: eMudhra intermediate CA compromise: the private keys of several eMudhra intermediate CA certificates were compromised. release: updated the Envoy docker images so they no longer trust the compromised eMudhra CAs. mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Serve…
Summary of changes: Bug fixes: aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration. composite: fixed a race where the route-level configuration of the composite filter could be destroyed on a worker thread when an RDS update replaced the route configuration.…
Summary of changes: Upstream security fixes: wasm: bumped wasmtime to 24.0.10 to resolve CVE-2026-54786. Bug fixes: aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration. dynamic_modules: fixed a bug where the per-route config destroy hook could run on a worke…
Summary of changes: Upstream security fixes: CVE-2026-54786: wasm: bumped wasmtime to 24.0.10 to resolve CVE-2026-54786. Bug fixes: aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration. local_ratelimit: fixed a race where the share provider manager owned by a…
Summary of changes: Upstream security fixes: CVE-2026-54786: wasm: bumped wasmtime to 24.0.10 to resolve CVE-2026-54786. Bug fixes: aws: fixed a race where the route-level configuration of the AWS request signing and AWS Lambda filters could be destroyed on a worker thread when an RDS update replaced the route configuration. local_ratelimit: fixed a race where the share provider manager owned by a…
Summary of changes: Security fixes: GHSA-8vc2-jrm4-835w: oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400. GHSA-47vj-9r25-wv5j: api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source. Docker images: https://hub.docker.com/r/…
Summary of changes: Security fixes: GHSA-8vc2-jrm4-835w: oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400. GHSA-47vj-9r25-wv5j: api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source. Docker images: https://hub.docker.com/r/…
Summary of changes: Security fixes: GHSA-8vc2-jrm4-835w: oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400. GHSA-47vj-9r25-wv5j: api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source. Docker images: https://hub.docker.com/r/…
Summary of changes: Security fixes: GHSA-8vc2-jrm4-835w: oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400. GHSA-47vj-9r25-wv5j: api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source. Docker images: https://hub.docker.com/r/…
Summary of changes: Security fixes: CVE-2026-35189: tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (--define boringssl=fips) does not receive this patch. Build/packaging: Removed Debian bullseye (11) packagi…
Summary of changes: Security fixes: CVE-2026-35189: tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (--config=boringssl-fips) does not receive this patch. Build/packaging: Removed Debian bullseye (11) packagi…
Summary of changes: Security fixes: CVE-2026-35189: tls: updated BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. Build/packaging: Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on t…
Summary of changes: Security fixes: CVE-2026-35189: tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. Note that the FIPS build is not patched. Build/packaging: Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its…
Summary of changes: Security fixes: CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment. CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames. CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag…
Summary of changes: Security fixes: CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment. CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames. CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag…
Summary of changes: Security fixes: CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment. CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames. CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag…
Summary of changes: Security fixes: CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment. CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames. CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag…
Summary of changes: Security fixes: CVE-2026-47205:Authz per route crash CVE-2026-47207: ext_proc response in one gRPC message CVE-2026-47221: router internal redirects crash CVE-2026-47775: OAuth2 code verifier padding oracle CVE-2026-48044: zstd RLE zip bomb CVE-2026-47204: grpc_stats filter segfault on Connect protocol requests to direct_response routes CVE-2026-47692: PROXY Protocol v2 header…
Summary of changes Breaking changes build: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, --enable_workspace and --noenable_bzlmod are required and have been added to .bazelrc; external-repository runfiles now appear directly under the runfiles root. build: the Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled for all builds due to a broken source a…
Summary of changes: Security fixes: CVE-2026-47207: ext_proc response in one gRPC message CVE-2026-47221: router internal redirects crash CVE-2026-47775: OAuth2 code verifier padding oracle CVE-2026-48044: zstd RLE zip bomb CVE-2026-47204: grpc_stats filter segfault on Connect protocol requests to direct_response routes CVE-2026-47692: PROXY Protocol v2 header generator emits "skipped" TLVs, causi…
Summary of changes: Security fixes: CVE-2026-47205:Authz per route crash CVE-2026-47207: ext_proc response in one gRPC message CVE-2026-47221: router internal redirects crash CVE-2026-47220: REQUESTED_SERVER_NAME crash CVE-2026-47775: OAuth2 code verifier padding oracle CVE-2026-48044: zstd RLE zip bomb CVE-2026-47204: grpc_stats filter segfault on Connect protocol requests to direct_response rout…
Summary of changes: Security fixes: CVE-2026-47205: Authz per route crash CVE-2026-47207: ext_proc response in one gRPC message CVE-2026-47221: router internal redirects crash CVE-2026-47220: REQUESTED_SERVER_NAME crash CVE-2026-47775: OAuth2 code verifier padding oracle CVE-2026-48044: zstd RLE zip bomb CVE-2026-47204: grpc_stats filter segfault on Connect protocol requests to direct_response rou…