Envoy
v1.39.1Networking & MessagingA security-focused release with fixes across HTTP, URL normalization, authorization, QUIC, TLS, and extensibility. It also includes ordinary correctness fixes and memory-management fixes.
Action needed (5)
securityCVE-2026-73512,
http3frame-sequence use-after-freeCVE-2026-73512 (GHSA-r6j2-mrm5-72mg) fixes a use-after-free in
http3when a specifically timed sequence of HTTP/3 frames is received. The fix ships in Envoy v1.39.1.securityCVE-2026-73513,
http2trailers withoutEND_STREAMCVE-2026-73513 (GHSA-jjmm-fw8p-crpw) fixes abnormal process termination in
http2when trailers arrive without theEND_STREAMflag. The fix ships in Envoy v1.39.1.securityCVE-2026-73547,
ext_authzhandling of pathless requestsCVE-2026-73547 (GHSA-87ph-jqwm-pg6r) fixes abnormal process termination in
ext_authzfor requests without a URI path, includingCONNECTrequests. The fix ships in Envoy v1.39.1.securityCVE-2026-73550,
http2limits for droppedHostheadersCVE-2026-73550 (GHSA-qgf6-qvhw-4hvh) makes dropped
Hostheaders count towardhttp2request header map size and count limits. The change ships in Envoy v1.39.1 and can be reverted withenvoy..reloadable_features. http2_track_size_of_dropped_host_header securityCVE-2026-48521, HTTP/3 upstream protocol selection
CVE-2026-48521 (GHSA-5vff-j9p4-38j3) fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3. The fix ships in Envoy v1.39.1.
Check if affected (8)
securityCVE-2026-73511, per-segment URL path-parameter stripping
Applies if you use URL normalization and do not enable
envoy..reloadable_features. strip_path_parameters_per_segment CVE-2026-73511 (GHSA-m745-gh6x-349x) changes URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The change ships in Envoy v1.39.1 and can be reverted with
envoy..reloadable_features. strip_path_parameters_per_segment securityCVE-2026-73546, sanitized
adminHTML stat namesApplies if you use the
adminsubsystem and enableenvoy..reloadable_features. sanitize_html_stats_names CVE-2026-73546 (GHSA-pv9h-4fxf-7vrg) sanitizes
adminstat names before converting them to HTML. The fix ships in Envoy v1.39.1 and is guarded byenvoy..reloadable_features. sanitize_html_stats_names securityCVE-2026-73548, generic HTTP upgrade request-body handling
Applies if you use HTTP and do not enable
envoy..reloadable_features. http_pause_generic_upgrade_request_body CVE-2026-73548 (GHSA-3vhp-c83q-jqc2) prevents payload sent before a generic HTTP upgrade is accepted from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection. The change ships in Envoy v1.39.1 and can be reverted with
envoy..reloadable_features. http_pause_generic_upgrade_request_body securityCVE-2026-73549, scoped IPv6 addresses in QUIC
Applies if you use QUIC client connections or Original Dst clusters.
CVE-2026-73549 (GHSA-jp5f-qr64-c9vw) fixes a crash when handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. The fix ships in Envoy v1.39.1.
securityCVE-2026-73551, parameter stripping from dot segments
Applies if
normalize_pathis configured and you do not enableenvoy..reloadable_features. strip_dotdot_segments_with_parameters CVE-2026-73551 (GHSA-2w8w-rfw7-8gg4) strips path parameters from dot and dotdot segments such as
/.and; /., so path canonicalization interprets them correctly. The fix ships in Envoy v1.39.1 when. ; normalize_pathis enabled, and can be reverted withenvoy..reloadable_features. strip_dotdot_segments_with_parameters securityCVE-2026-73552, Latin1 charset mode for
safe_regexApplies if you use
safe_regexand do not enableenvoy..reloadable_features. re2_use_latin1_mode CVE-2026-73552 (GHSA-23xh-2qxr-3xv8) changes
safe_regexcharset mode from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The change ships in Envoy v1.39.1 and can be reverted withenvoy..reloadable_features. re2_use_latin1_mode securityCVE-2026-73553, RBAC path matching with ignored parameters
Applies if you use
rbac, configureignore_path_parameters_in_path_matching, and do not enableenvoy..reloadable_features. rbac_respect_ignore_path_parameters CVE-2026-73553 (GHSA-77x5-xqjg-hprq) makes RBAC path matching respect the route's
ignore_path_parameters_in_path_matching, preventing authorization bypass through appended path parameters. The fix ships in Envoy v1.39.1 and can be reverted withenvoy..reloadable_features. rbac_respect_ignore_path_parameters securityCVE-2026-50572, HTTP
ext_authzrejection handlingApplies if you use
ext_authzand HTTP.CVE-2026-50572 (GHSA-q8wp-gf7q-m8cv) fixes a use-after-free when
ext_authzover HTTP causes a request to be rejected. The fix ships in Envoy v1.39.1.
All 4 other recorded changesfixes 4
fixes (4)
- - http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via
addDecodedData()/addEncodedData()immediately before returningContinuewas silently dropped, corrupting large streamed bodies. Revert withenvoy..reloadable_features. filter_manager_forward_added_data_on_continue - - ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
- - tls: fixed a memory leak in the OpenSSL compatibility layer where
SSL_get0_peer_certificates()leaked anX509refcount per call, preventing certificates from being freed on connection close. - - tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.
A weekly email arrives when a release needs action. Like the security patches in this release.