Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×Project: EnvoyClear ×

Envoyv1.37.1Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 11View full analysis

A maintenance release with security fixes for crashes, header handling, JSON memory writes, and downstream reset processing. It also includes ordinary bug fixes, updates to published artifacts, and a dynamic-module compatibility change.

Action needed (3)

securitymediumCVE-2026-26310 and GHSA-3cw6-2j68-868p: scoped IPv6 crash fix in getAddressWithPort()
The network getAddressWithPort() path no longer crashes when called with a scoped IPv6 address. This release includes CVE-2026-26310 and GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 and GHSA-56cj-wgg3-x943: JSON null-terminator write fix
The JSON handling code fixes an off-by-one write that could corrupt the string null terminator. This release includes CVE-2026-26309 and GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 and GHSA-84xm-r438-86px: HTTP decode* blocking after downstream reset
HTTP decode* methods are blocked after a downstream reset. This release includes CVE-2026-26311 and GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 and GHSA-ghc4-35x6-crw5: multivalue header bypass fix in RBAC
Applies if you use the rbac subsystem.
RBAC no longer permits a multivalue header bypass. This release includes CVE-2026-26308 and GHSA-ghc4-35x6-crw5.
securitymediumCVE-2026-26330 and GHSA-c23c-rp3m-vpg3: ratelimit response-phase limit crash fix
Applies if you use the ratelimit subsystem.
The ratelimit response phase limit no longer causes a crash. This release includes CVE-2026-26330 and GHSA-c23c-rp3m-vpg3.

Source ↗

Envoyv1.36.5Networking & MessagingMar 11, 2026

ACTION 3CHECK 2OTHER 4View full analysis

A security-focused release with fixes spanning request handling, network address processing, JSON, and HTTP decoding. It also includes a bug fix plus dependency and image updates.

Action needed (3)

securitymediumCVE-2026-26310 scoped IPv6 address crash fix
Envoy fixes a crash in getAddressWithPort() when it is called with a scoped IPv6 address. The advisory is tracked as GHSA-3cw6-2j68-868p.
securitymediumCVE-2026-26309 json null terminator write fix
Envoy fixes an off-by-one write in json that could corrupt the string null terminator. The advisory is tracked as GHSA-56cj-wgg3-x943.
securitymediumCVE-2026-26311 HTTP decoder reset handling
Envoy blocks decode* methods after a downstream reset. The advisory is tracked as GHSA-84xm-r438-86px.

Check if affected (2)

securityhighCVE-2026-26308 rbac multivalue header bypass fix
Applies if you use rbac.
Envoy fixes a multivalue header bypass in rbac. The advisory is tracked as GHSA-ghc4-35x6-crw5.
securitymediumCVE-2026-26330 ratelimit response phase limit crash fix
Applies if you use ratelimit.
Envoy fixes a bug where the ratelimit response phase limit could cause a crash. The advisory is tracked as GHSA-c23c-rp3m-vpg3.

Source ↗

Browse by month