RATATOSKRATATOSK
Sign in

Envoy

v1.37.8Networking & Messaging
Oct 6, 2026

CHECK 2

A security maintenance release fixes crashes in the Envoy `oauth2` and `api_key_auth` filters. The `oauth2` filter now rejects requests without a `:path` header with HTTP `400`, while the other fix covers a specific `hide_credentials` and query key source configuration.

Check if affected (2)

  • securityGHSA-8vc2-jrm4-835w in the oauth2 filter

    Applies if the oauth2 filter receives requests without a :path header.

    GHSA-8vc2-jrm4-835w fixes a crash in the oauth2 filter for requests without a :path header, including CONNECT requests. The filter now rejects these requests with HTTP 400.

    GHSA-8vc2-jrm4-835w

  • securityGHSA-47vj-9r25-wv5j in the api_key_auth filter

    Applies if hide_credentials is enabled with a query key source and a request without a :path header is authenticated via another key source.

    GHSA-47vj-9r25-wv5j fixes a crash in the api_key_auth filter when hide_credentials is enabled with a query key source and a request without a :path header is authenticated through another key source.

    GHSA-47vj-9r25-wv5j

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Envoy releases →