Envoy
v1.35.9Networking & MessagingEnvoy v1.35.9 delivers critical security patches for four CVEs affecting RBAC, IPv6 handling, JSON processing, and HTTP decoding, plus OAuth2 host rewriting fixes.
securityUpgrade immediately for critical security fixes
Four CVEs fixed in this release could lead to authentication bypass, crashes, and memory corruption. Schedule immediate deployment especially if using RBAC policies, IPv6 networking, JSON processing, or experiencing downstream connection resets. Test thoroughly in staging first as security fixes can affect request handling behavior.
enhancementValidate OAuth2 host rewriting behavior
OAuth2 refresh requests now correctly preserve original Host headers instead of being overridden. If your setup relies on custom host rewriting for OAuth2 flows, verify that authentication still works as expected after upgrading. This change improves compliance with OAuth2 specifications.
Key changes (5)
- Four CVE fixes addressing RBAC multivalue header bypass, IPv6 crash, JSON corruption, and HTTP decode blocking issues
- OAuth2 refresh requests now preserve original Host header values during host rewriting
- Migration from internal googleurl to open GitHub repository (google/gurl)
- Kafka test binary updated to version 3.9.2
- Docker base images refreshed to latest versions