Releases

Check if affected (2)

• breakingThe envoy.network.connection_balance.dlb extension removal

  Applies if you use envoy.network.connection_balance.dlb.

  The contrib extension envoy.network.connection_balance.dlb, the Intel DLB connection balancer, was disabled at the Bazel layer for all builds and platforms because of a source archive breakage.

• breakingThe envoy.reloadable_features.tls_certificate_compression_brotli default

  Applies if you do not configure envoy.reloadable_features.tls_certificate_compression_brotli.

  The runtime guard envoy.reloadable_features.tls_certificate_compression_brotli is disabled by default.

Check if affected (16)

• securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220

  Applies if you configure REQUESTED_SERVER_NAME.

  This release fixes the REQUESTED_SERVER_NAME crash described by CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.

• securityhighzstd RLE zip bomb fix, CVE-2026-48044

  Applies if you depend on zstd.

  This release fixes the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

• securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042

  Applies if you use JSON.

  This release fixes the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

• + 13 more on the release page

Check if affected (15)

• securityhighzstd RLE zip bomb correction

  Applies if you use zstd.

  The zstd RLE zip bomb issue is corrected in connection with CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

• securityhighHTTP/3 to HTTP/1 request smuggling

  Applies if you use HTTP/3 and HTTP/1.

  The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with nonzero Content-Length is corrected in connection with CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.

• securityhighcom_github_wasmtime dependency update

  Applies if you use wasm.

  The wasm dependency com_github_wasmtime is bumped to resolve CVE-2026-47261.

• + 12 more on the release page

Check if affected (14)

• securityhighzstd RLE zip bomb, corrected for CVE-2026-48044

  Applies if you use zstd.

  This release corrects the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.

• securityhighHTTP/3 headers-only content-length validation, corrected for CVE-2026-48743

  Applies if you use HTTP/3.

  This release corrects validation of content length for HTTP/3 headers-only requests and responses under CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.

• securityhighcom_github_wasmtime dependency update for CVE-2026-47261

  Applies if you use wasm.

  For wasm, this release bumps com_github_wasmtime to resolve CVE-2026-47261.

• + 11 more on the release page

Check if affected (4)

• securityhighHTTP/2 header-limit enforcement and cookie accounting

  Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.

  HTTP/2 streams are reset when they exceed the configured maximum header list size, and uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count. This addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8; the behavior can be reverted with envoy.reloadable_features.http2_include_cookies_in_limits.

• securityOAuth2 HMAC verification timing side-channel fix

  Applies if you use oauth2.

  The OAuth2 HMAC verification path no longer has the timing side-channel described in the release note, which could leak whether an HMAC secret was valid. The fix ships in v1.38.1.

• breakingRouter transport-failure reason response body

  Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.

  The upstream transport failure reason is no longer included in HTTP response bodies sent to downstream clients. It remains available in access logs through %UPSTREAM_TRANSPORT_FAILURE_REASON%, and the response-body behavior can be reverted with envoy.reloadable_features.hide_transport_failure_reason_in_response_body.

• + 1 more on the release page

Check if affected (2)

• securityhighHTTP/2 header list limits and cookie accounting

  Applies if you use HTTP/2.

  HTTP/2 streams are reset when they violate the configured maximum header list size. Uncompressed cookies now count toward the mutable_max_request_headers_kb and max_headers_count limits, addressing the HPACK cookie-bomb described by CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.

• securityOAuth2 HMAC verification timing

  Applies if you use oauth2.

  The oauth2 filter no longer has the HMAC verification timing side-channel that could leak HMAC secret validity. This fix ships in the release.

Check if affected (2)

• securityhighHTTP/2 header-limit enforcement and cookie accounting

  Applies if you use HTTP/2 with configured header list or request-header limits.

  In Envoy v1.36.7, http2 resets streams that violate the configured maximum header list size. Uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count limits. The change addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.

• securityOAuth2 HMAC verification timing side-channel fix

  Applies if you use the OAuth2 filter.

  Envoy v1.36.7 fixes a timing side-channel in the oauth2 filter's HMAC verification that could reveal whether an HMAC secret was valid.

Check if affected (2)

• securityhighHTTP/2 header limits and cookie accounting

  Applies if you use HTTP/2 request header limits.

  Envoy v1.35.11 resets HTTP/2 streams that exceed the configured maximum header list size. Uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count, and the behavior can be reverted with envoy.reloadable_features.http2_include_cookies_in_limits. The change addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8.

• securityOAuth2 HMAC verification timing protection

  Applies if you use OAuth2 HMAC verification.

  Envoy v1.35.11 fixes a timing side channel in OAuth2 HMAC verification that could reveal whether an HMAC secret is valid.