RATATOSKRATATOSK
Sign in

Envoy

v1.37.11Networking & Messaging
Oct 26, 2026

ACTION 1

A targeted security maintenance release updates the CA bundle in the `distroless` image. It removes trust in compromised eMudhra intermediate CAs by shipping Debian bookworm's patched `ca-certificates` package.

Action needed (1)

  • securityThe distroless image's CA bundle

    The distroless Docker image now uses Debian bookworm's patched ca-certificates package, version 20250419~deb12u2. The updated bundle no longer trusts the roots of the compromised eMudhra intermediate CAs; the distroless image in 1.37.10 still contained the unpatched bundle.

    eMudhra intermediate CA compromise

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Envoy releases →