RATATOSKRATATOSK
Sign in

Envoy

v1.39.5Networking & Messaging
Oct 23, 2026

CHECK 3OTHER 1

A targeted security release removes trust in compromised eMudhra certificate authorities from Envoy images, Envoy Mobile, and selected DNS resolver dependencies. It also restores peer metadata conversion to use the peer's `app` and `version` labels before falling back to Kubernetes labels.

Check if affected (3)

  • securityEnvoy docker image trust removal

    Applies if you use Envoy docker images.

    The Envoy docker images no longer trust the compromised eMudhra certificate authorities.

  • securityEnvoy Mobile root certificate removal

    Applies if you use Envoy Mobile.

    The root certificate bundle built into Envoy Mobile no longer includes AAA Certificate Services or emSign ECC Root CA - G3.

  • securityHickory DNS resolver certificate trust

    Applies if you use the built-in Hickory DNS resolver with DNS-over-TLS upstreams and DNS-over-HTTPS upstreams.

    The webpki-roots and rustls-webpki crates used by the built-in Hickory DNS resolver were updated. DNS-over-TLS and DNS-over-HTTPS upstreams no longer trust the compromised eMudhra intermediate certificate authorities.

All 1 other recorded changesvalue changes 1

value changes (1)

  • peer metadata conversion takes a peer's app name and version from the app and version labels again, falling back to app.kubernetes.io/name and app.kubernetes.io/version only when those are absent or empty.
Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Envoy releases →