RATATOSKRATATOSK
Sign in

Envoy

v1.37.7Networking & Messaging
Oct 1, 2026

ACTION 1CHECK 1

A maintenance release with a BoringSSL fix for remote denial of service during TLS handshakes and the removal of Debian bullseye packaging. The fix does not apply to FIPS BoringSSL builds.

Action needed (1)

  • breakingDebian bullseye (11) packaging removal

    Debian bullseye (11) packaging was removed because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

Check if affected (1)

  • securitymediumCVE-2026-35189 BoringSSL certificate parsing fix

    Applies if you do not use the BoringSSL FIPS build (--define boringssl=fips).

    BoringSSL was patched to prevent excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points. The issue could permit remote denial of service during TLS handshakes, and the BoringSSL FIPS build (--define boringssl=fips) does not receive this patch.

    CVE-2026-35189

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Envoy releases →