RATATOSKRATATOSK
Sign in

Envoy

v1.38.5Networking & Messaging
Oct 1, 2026

ACTION 2

A security and packaging maintenance release with a BoringSSL fix for a remotely exploitable denial-of-service issue. It also removes Debian bullseye packaging and includes internal release-build updates.

Action needed (2)

  • securitymediumCVE-2026-35189 BoringSSL certificate parsing fix

    This release patches BoringSSL to prevent excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could cause remote denial of service during TLS handshakes. The BoringSSL FIPS build using --config=boringssl-fips does not receive this patch.

    CVE-2026-35189

  • breakingDebian bullseye (11) packaging removal

    This release removes Debian bullseye (11) packaging because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Envoy releases →