RATATOSKRATATOSK
Sign in

Envoy

v1.39.2Networking & Messaging
Oct 1, 2026

ACTION 1CHECK 1OTHER 1

A security and packaging release that fixes a remotely exploitable TLS denial of service and removes Debian bullseye packaging. It also refreshes the Ubuntu build and distroless Docker base images without noted runtime configuration changes.

Action needed (1)

  • securitymediumCVE-2026-35189 TLS certificate parsing fix

    BoringSSL was updated to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points. The fix addresses CVE-2026-35189, which could enable remote denial of service during TLS handshakes.

    CVE-2026-35189

Check if affected (1)

  • breakingDebian bullseye (11) packaging removal

    Applies if you use Debian bullseye (11) packaging.

    Debian bullseye (11) packaging was removed because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

All 1 other recorded changesvalue changes 1

value changes (1)

  • - Refreshed the Ubuntu build and distroless Docker base images.
Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Envoy releases →