Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: EnvoyClear ×

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
HTTP/2 counts uncompressed cookies toward header-size and header-count limits, strengthens PRIORITY and WINDOW_UPDATE flood protection, and adds configurable nghttp2 RST_STREAM rate limits in v1.39.0. The release addresses CVE-2026-47774.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
HTTP/3 security fixes address QPACK blocked-decoding denial of service and inconsistent headers-only content-length handling in v1.39.0. The fixes address GHSA-p7c7-7c47-pwch and CVE-2026-48743.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
Additional security fixes for DNS query validation, JSON nesting limits, PROXY protocol TLV smuggling, formatter crashes, TCP StatsD overflow, TLS SAN NUL handling, and Zstd decompression memory exhaustion ship in v1.39.0. The fixes address CVE-2026-48497, CVE-2026-48042, CVE-2026-47692, CVE-2026-47220, CVE-2026-48706, CVE-2026-47778, and CVE-2026-48044.
+ 8 more on the release page

Source ↗

Envoyv1.37.5Networking & MessagingJun 23, 2026

ACTION 1CHECK 16View full analysis

A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy.network.connection_balance.dlb contrib extension at the Bazel layer for all builds and platforms.

Action needed (1)

securityhighcom_github_wasmtime dependency update, CVE-2026-47261
The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Check if affected (16)

securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220
Applies if you configure REQUESTED_SERVER_NAME.
This release fixes the REQUESTED_SERVER_NAME crash described by CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb fix, CVE-2026-48044
Applies if you depend on zstd.
This release fixes the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042
Applies if you use JSON.
This release fixes the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
+ 13 more on the release page

Source ↗

Envoyv1.36.9Networking & MessagingJun 23, 2026

ACTION 1CHECK 15View full analysis

A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy.network.connection_balance.dlb is disabled in all builds.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow
The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (15)

securityhighzstd RLE zip bomb correction
Applies if you use zstd.
The zstd RLE zip bomb issue is corrected in connection with CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHTTP/3 to HTTP/1 request smuggling
Applies if you use HTTP/3 and HTTP/1.
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with nonzero Content-Length is corrected in connection with CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securityhighcom_github_wasmtime dependency update
Applies if you use wasm.
The wasm dependency com_github_wasmtime is bumped to resolve CVE-2026-47261.
+ 12 more on the release page

Source ↗

Envoyv1.35.13Networking & MessagingJun 23, 2026

ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042
This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

securityhighzstd RLE zip bomb, corrected for CVE-2026-48044
Applies if you use zstd.
This release corrects the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHTTP/3 headers-only content-length validation, corrected for CVE-2026-48743
Applies if you use HTTP/3.
This release corrects validation of content length for HTTP/3 headers-only requests and responses under CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securityhighcom_github_wasmtime dependency update for CVE-2026-47261
Applies if you use wasm.
For wasm, this release bumps com_github_wasmtime to resolve CVE-2026-47261.
+ 11 more on the release page

Source ↗

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
HTTP/2 streams are reset when they exceed the configured maximum header list size, and uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count. This addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8; the behavior can be reverted with envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
The OAuth2 HMAC verification path no longer has the timing side-channel described in the release note, which could leak whether an HMAC secret was valid. The fix ships in v1.38.1.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
The upstream transport failure reason is no longer included in HTTP response bodies sent to downstream clients. It remains available in access logs through %UPSTREAM_TRANSPORT_FAILURE_REASON%, and the response-body behavior can be reverted with envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Source ↗

Envoyv1.37.3Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

A maintenance release focused on security and correctness fixes. The remaining heading-only items have no operator-facing changes.

Action needed (1)

securityhighnghttp2 CVE-2026-27135 patch
The nghttp2 CVE-2026-27135 patch is applied in the release.

Check if affected (2)

securityhighHTTP/2 header list limits and cookie accounting
Applies if you use HTTP/2.
HTTP/2 streams are reset when they violate the configured maximum header list size. Uncompressed cookies now count toward the mutable_max_request_headers_kb and max_headers_count limits, addressing the HPACK cookie-bomb described by CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.
securityOAuth2 HMAC verification timing
Applies if you use oauth2.
The oauth2 filter no longer has the HMAC verification timing side-channel that could leak HMAC secret validity. This fix ships in the release.

Source ↗

Envoyv1.36.7Networking & MessagingJun 4, 2026

ACTION 1CHECK 2OTHER 2View full analysis

Envoy v1.36.7 is a security-focused update with changes to HTTP/2 handling and OAuth2 authentication. It also includes an nghttp2 security patch, so deployments using these components are directly affected.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.36.7 applies the nghttp2 patch for CVE-2026-27135 in its HTTP/2 handling.

Check if affected (2)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 with configured header list or request-header limits.
In Envoy v1.36.7, http2 resets streams that violate the configured maximum header list size. Uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count limits. The change addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use the OAuth2 filter.
Envoy v1.36.7 fixes a timing side-channel in the oauth2 filter's HMAC verification that could reveal whether an HMAC secret was valid.

Source ↗

Envoyv1.35.11Networking & MessagingJun 3, 2026

ACTION 1CHECK 2OTHER 4View full analysis

Envoy v1.35.11 is a security-focused release with fixes in HTTP/2, OAuth2, and nghttp2. It also includes ordinary bug fixes and new statistics capabilities, while the security changes are the ones that require upgrading.

Action needed (1)

securityhighThe nghttp2 CVE-2026-27135 patch
Envoy v1.35.11 applies the nghttp2 patch for CVE-2026-27135.

Check if affected (2)

securityhighHTTP/2 header limits and cookie accounting
Applies if you use HTTP/2 request header limits.
Envoy v1.35.11 resets HTTP/2 streams that exceed the configured maximum header list size. Uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count, and the behavior can be reverted with envoy.reloadable_features.http2_include_cookies_in_limits. The change addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.
securityOAuth2 HMAC verification timing protection
Applies if you use OAuth2 HMAC verification.
Envoy v1.35.11 fixes a timing side channel in OAuth2 HMAC verification that could reveal whether an HMAC secret is valid.

Source ↗

Envoyv1.38.0Networking & MessagingApr 23, 2026

ACTION 1CHECK 6PLAN 1OTHER 77View full analysis

A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.

Action needed (1)

securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.

Check if affected (6)

securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
Query-parameter values added through query_parameter_mutations are now URL-encoded to prevent injection.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
RBAC handling was corrected to prevent concatenation-based bypasses.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
max_early_data_bytes must now be set explicitly when upstream_connect_mode has a value other than IMMEDIATE. Missing configuration causes validation to fail at startup.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.
The enforce_rsa_key_usage option is deprecated and will be removed in the next release.

Source ↗

Envoyv1.37.1Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
RBAC no longer permits a multivalue header bypass. This release includes CVE-2026-26308 and GHSA-ghc4-35x6-crw5.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.
The ratelimit response phase limit no longer causes a crash. This release includes CVE-2026-26330 and GHSA-c23c-rp3m-vpg3.

Source ↗

Envoyv1.36.5Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
Envoy fixes a multivalue header bypass in rbac. The advisory is tracked as GHSA-ghc4-35x6-crw5.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.
Envoy fixes a bug where the ratelimit response phase limit could cause a crash. The advisory is tracked as GHSA-c23c-rp3m-vpg3.

Source ↗

Browse by month