RATATOSKRATATOSK
Sign in

Envoy

v1.38.4Networking & Messaging
Aug 26, 2026

ACTION 1CHECK 12OTHER 5

A security-focused maintenance release with vulnerability fixes across URL normalization, HTTP protocols, authorization, regular-expression handling, and QUIC. It also includes crash and memory-safety corrections, plus fixes for HTTP filter, external processing, routing, and TLS lifetime and allocation issues.

Action needed (1)

  • securityCVE-2026-73511, URL path-parameter normalization

    This release changes URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The behavior can be reverted with envoy.reloadable_features.strip_path_parameters_per_segment.

    CVE-2026-73511

Check if affected (12)

  • securityCVE-2026-73512, http3 frame-sequence use-after-free

    Applies if you run http3.

    This release fixes a use-after-free in http3 triggered by a specifically timed sequence of HTTP/3 frames.

    CVE-2026-73512

  • securityCVE-2026-73513, http2 trailers without END_STREAM

    Applies if you run http2.

    This release fixes abnormal process termination in http2 when trailers arrive without the END_STREAM flag.

    CVE-2026-73513

  • securityCVE-2026-73546, admin stat-name HTML sanitization

    Applies if envoy.reloadable_features.sanitize_html_stats_names is enabled.

    This release sanitizes admin stat names before converting them to HTML. The behavior is guarded by envoy.reloadable_features.sanitize_html_stats_names.

    CVE-2026-73546

  • securityCVE-2026-73547, ext_authz requests without a URI path

    Applies if you run ext_authz.

    This release fixes abnormal process termination in ext_authz for requests without a URI path, including CONNECT requests.

    CVE-2026-73547

  • securityCVE-2026-73548, generic HTTP upgrade request-body handling

    Applies if you run http.

    This release prevents payload sent before a generic HTTP upgrade is accepted from being interpreted as a pipelined HTTP/1 request that poisons a shared upstream connection. The behavior can be reverted with envoy.reloadable_features.http_pause_generic_upgrade_request_body.

    CVE-2026-73548

  • securityCVE-2026-73549, scoped IPv6 handling in quic

    Applies if you run quic.

    This release fixes a crash in quic client connections and Original Dst clusters when handling scoped IPv6 addresses.

    CVE-2026-73549

  • securityCVE-2026-73550, dropped Host header accounting in http2

    Applies if you run http2.

    This release counts dropped Host headers toward request header map size and count limits in http2. The behavior can be reverted with envoy.reloadable_features.http2_track_size_of_dropped_host_header.

    CVE-2026-73550

  • securityCVE-2026-73551, dot-segment path-parameter normalization

    Applies if normalize_path is enabled.

    This release strips path parameters from dot and dotdot segments such as /.; and /..;, so URL canonicalization interprets them correctly. The behavior can be reverted with envoy.reloadable_features.strip_dotdot_segments_with_parameters.

    CVE-2026-73551

  • securityCVE-2026-73552, safe_regex Latin1 character-set mode

    Applies if you run safe_regex.

    This release changes safe_regex character-set mode from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The behavior can be reverted with envoy.reloadable_features.re2_use_latin1_mode.

    CVE-2026-73552

  • securityCVE-2026-73553, rbac path-parameter matching

    Applies if you run rbac and configure ignore_path_parameters_in_path_matching.

    This release makes rbac path matching respect the route's ignore_path_parameters_in_path_matching, preventing authorization bypass through appended path parameters. The behavior can be reverted with envoy.reloadable_features.rbac_respect_ignore_path_parameters.

    CVE-2026-73553

  • securityCVE-2026-50572, HTTP ext_authz request-rejection use-after-free

    Applies if you run ext_authz.

    This release fixes a use-after-free in ext_authz over HTTP when a request is rejected.

    CVE-2026-50572

  • securityCVE-2026-48521, ALPN-selected HTTP/3 upstream handling

    Applies if you run http3.

    This release fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3.

    CVE-2026-48521

All 5 other recorded changesfixes 5

fixes (5)

  • - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
  • - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
  • - router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending.
  • - tls: fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
  • - tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.
Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Envoy releases →