Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: EnvoyClear ×

Envoyv1.39.0Networking & MessagingJul 14, 2026

CHECK 11OTHER 50View full analysis

A broad release with operator-facing changes across configuration, protocols, extensions, networking, and observability. Security fixes address multiple identified CVEs and a GHSA, while changed defaults, stricter input validation, and removed functionality may affect existing deployments.

Check if affected (11)

securityhighHTTP/2 header limits and flood protection
Applies if you use HTTP/2.
HTTP/2 counts uncompressed cookies toward header-size and header-count limits, strengthens PRIORITY and WINDOW_UPDATE flood protection, and adds configurable nghttp2 RST_STREAM rate limits in v1.39.0. The release addresses CVE-2026-47774.
securityhighHTTP/3 QPACK and content-length security fixes
Applies if you use HTTP/3.
HTTP/3 security fixes address QPACK blocked-decoding denial of service and inconsistent headers-only content-length handling in v1.39.0. The fixes address GHSA-p7c7-7c47-pwch and CVE-2026-48743.
securityhighAdditional protocol, parser, formatter, and decompression security fixes
Applies if you use DNS query validation, JSON nesting limits, PROXY protocol TLV, the formatter, TCP StatsD, TLS SAN, or Zstd decompression.
Additional security fixes for DNS query validation, JSON nesting limits, PROXY protocol TLV smuggling, formatter crashes, TCP StatsD overflow, TLS SAN NUL handling, and Zstd decompression memory exhaustion ship in v1.39.0. The fixes address CVE-2026-48497, CVE-2026-48042, CVE-2026-47692, CVE-2026-47220, CVE-2026-48706, CVE-2026-47778, and CVE-2026-48044.
+ 8 more on the release page

Source ↗

Envoyv1.38.3Networking & MessagingJun 23, 2026

ACTION 16CHECK 2View full analysis

A maintenance release with multiple disclosed security fixes and a security-related Wasmtime dependency update. It also removes the Intel DLB connection-balancer extension from all builds and disables TLS certificate compression by default.

Action needed (16)

securityhighThe com_github_wasmtime dependency update
The Wasmtime dependency com_github_wasmtime was updated to resolve CVE-2026-47261. The update ships in the WebAssembly build.
securityhighREQUESTED_SERVER_NAME crash, CVE-2026-47220
The REQUESTED_SERVER_NAME crash was corrected in Envoy. The change addresses CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb, CVE-2026-48044
The zstd RLE zip bomb issue was corrected in Envoy. The change addresses CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow, CVE-2026-48042
The stack overflow in the destructor of highly nested JSON was corrected in Envoy. The change addresses CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
securityhighHTTP/3 to HTTP/1 request smuggling, CVE-2026-48743
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with a nonzero Content-Length was corrected in Envoy. The change addresses CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securitymediumAuthz per route crash, CVE-2026-47205
The Authz per route crash was corrected in Envoy. The change addresses CVE-2026-47205 and GHSA-mvh9-767w-x47j.
securitymediumThe ext_proc response issue, CVE-2026-47207
The ext_proc response handling issue involving one gRPC message was corrected in Envoy. The change addresses CVE-2026-47207 and GHSA-68cv-hq5f-g6xv.
securitymediumRouter internal redirects crash, CVE-2026-47221
The router internal redirects crash was corrected in Envoy. The change addresses CVE-2026-47221 and GHSA-rcff-gw58-pjpr.
securitymediumOAuth2 code verifier padding oracle, CVE-2026-47775
The OAuth2 code verifier padding oracle issue was corrected in Envoy. The change addresses CVE-2026-47775 and GHSA-396h-jpq4-vc7p.
securitymediumThe grpc_stats filter segfault, CVE-2026-47204
The grpc_stats filter segfault on Connect protocol requests to direct_response routes was corrected in Envoy. The change addresses CVE-2026-47204 and GHSA-3jxh-8p6x-7pf6.
securitymediumPROXY Protocol v2 skipped TLVs, CVE-2026-47692
The PROXY Protocol v2 header generator issue involving skipped TLVs and attacker-controlled spillover into the upstream application stream was corrected in Envoy. The change addresses CVE-2026-47692 and GHSA-wh36-hm39-mm3r.
securitymediumEmbedded NUL in TLS SAN truncation, CVE-2026-47778
The embedded NUL issue in TLS SAN truncation that could cause an authorization bypass was corrected in Envoy. The change addresses CVE-2026-47778 and GHSA-f8x4-rw5x-f3r7.
securitymediumOAuth2 filter late token completion, CVE-2026-48090
The OAuth2 filter issue involving late asynchronous token completion after stream teardown was corrected in Envoy. The change addresses CVE-2026-48090 and GHSA-3cj2-c63f-q26f.
securitymediumDNS UDP filter abnormal process termination, CVE-2026-48497
The abnormal process termination in the DNS UDP filter was corrected in Envoy. The change addresses CVE-2026-48497 and GHSA-j6g2-wf95-q66q.
securitymediumThe TcpStatsdSink heap buffer overflow, CVE-2026-48706
The heap buffer overflow in TcpStatsdSink was corrected in Envoy. The change addresses CVE-2026-48706 and GHSA-7q3f-gwg7-j8g4.
securityHTTP/3 QPACK blocked decoding, GHSA-p7c7-7c47-pwch
The HTTP/3 stack issue involving QPACK blocked decoding was corrected in Envoy. The change addresses GHSA-p7c7-7c47-pwch.

Check if affected (2)

breakingThe envoy.network.connection_balance.dlb extension removal
Applies if you use envoy.network.connection_balance.dlb.
The contrib extension envoy.network.connection_balance.dlb, the Intel DLB connection balancer, was disabled at the Bazel layer for all builds and platforms because of a source archive breakage.
breakingThe envoy.reloadable_features.tls_certificate_compression_brotli default
Applies if you do not configure envoy.reloadable_features.tls_certificate_compression_brotli.
The runtime guard envoy.reloadable_features.tls_certificate_compression_brotli is disabled by default.

Source ↗

Envoyv1.37.5Networking & MessagingJun 23, 2026

ACTION 1CHECK 16View full analysis

A security-focused release with fixes for multiple Envoy components, extensions, protocols, and dependencies. It also disables the broken envoy.network.connection_balance.dlb contrib extension at the Bazel layer for all builds and platforms.

Action needed (1)

securityhighcom_github_wasmtime dependency update, CVE-2026-47261
The com_github_wasmtime dependency was bumped to resolve CVE-2026-47261.

Check if affected (16)

securityhighREQUESTED_SERVER_NAME crash fix, CVE-2026-47220
Applies if you configure REQUESTED_SERVER_NAME.
This release fixes the REQUESTED_SERVER_NAME crash described by CVE-2026-47220 and GHSA-j9wh-4qfm-wf2v.
securityhighzstd RLE zip bomb fix, CVE-2026-48044
Applies if you depend on zstd.
This release fixes the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHighly nested JSON destructor stack overflow fix, CVE-2026-48042
Applies if you use JSON.
This release fixes the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.
+ 13 more on the release page

Source ↗

Envoyv1.36.9Networking & MessagingJun 23, 2026

ACTION 1CHECK 15View full analysis

A security-focused release with fixes for crashes, request handling, protocol processing, authentication, and parsing, plus a security-related wasm dependency update. The contrib extension envoy.network.connection_balance.dlb is disabled in all builds.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow
The stack overflow in the destructor of highly nested JSON is corrected in connection with CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (15)

securityhighzstd RLE zip bomb correction
Applies if you use zstd.
The zstd RLE zip bomb issue is corrected in connection with CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHTTP/3 to HTTP/1 request smuggling
Applies if you use HTTP/3 and HTTP/1.
The HTTP/3 to HTTP/1 request smuggling issue involving a headers-only request with nonzero Content-Length is corrected in connection with CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securityhighcom_github_wasmtime dependency update
Applies if you use wasm.
The wasm dependency com_github_wasmtime is bumped to resolve CVE-2026-47261.
+ 12 more on the release page

Source ↗

Envoyv1.35.13Networking & MessagingJun 23, 2026

ACTION 1CHECK 14View full analysis

A security-focused maintenance release with fixes across filters, protocol handling, request processing, and JSON parsing. It also updates the Wasmtime dependency and disables the contrib extension envoy.network.connection_balance.dlb.

Action needed (1)

securityhighHighly nested JSON destructor stack overflow, corrected for CVE-2026-48042
This release corrects the stack overflow in the destructor of highly nested JSON described by CVE-2026-48042 and GHSA-f24p-rxw2-g6pv.

Check if affected (14)

securityhighzstd RLE zip bomb, corrected for CVE-2026-48044
Applies if you use zstd.
This release corrects the zstd RLE zip bomb described by CVE-2026-48044 and GHSA-m3p9-47wh-88wg.
securityhighHTTP/3 headers-only content-length validation, corrected for CVE-2026-48743
Applies if you use HTTP/3.
This release corrects validation of content length for HTTP/3 headers-only requests and responses under CVE-2026-48743 and GHSA-8phg-2h2q-jgxf.
securityhighcom_github_wasmtime dependency update for CVE-2026-47261
Applies if you use wasm.
For wasm, this release bumps com_github_wasmtime to resolve CVE-2026-47261.
+ 11 more on the release page

Source ↗

Envoyv1.38.1Networking & MessagingJun 4, 2026

ACTION 1CHECK 4OTHER 2View full analysis

A maintenance release with HTTP/2 protections, an nghttp2 patch, and an OAuth2 HMAC verification fix. It also changes router response-body output and EDS batch load-balancer rebuild defaults, while the release notes include crash fixes in OAuth2 token-cookie decryption and dynamic HTTP filters.

Action needed (1)

securityhighnghttp2 patch for CVE-2026-27135
The nghttp2 dependency includes the patch for CVE-2026-27135. The patched dependency ships in v1.38.1.

Check if affected (4)

securityhighHTTP/2 header-limit enforcement and cookie accounting
Applies if you use HTTP/2 and do not enable envoy.reloadable_features.http2_include_cookies_in_limits.
HTTP/2 streams are reset when they exceed the configured maximum header list size, and uncompressed cookies now count toward mutable_max_request_headers_kb and max_headers_count. This addresses CVE-2026-47774 and GHSA-22m2-hvr2-xqc8; the behavior can be reverted with envoy.reloadable_features.http2_include_cookies_in_limits.
securityOAuth2 HMAC verification timing side-channel fix
Applies if you use oauth2.
The OAuth2 HMAC verification path no longer has the timing side-channel described in the release note, which could leak whether an HMAC secret was valid. The fix ships in v1.38.1.
breakingRouter transport-failure reason response body
Applies if you use the router and do not enable envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
The upstream transport failure reason is no longer included in HTTP response bodies sent to downstream clients. It remains available in access logs through %UPSTREAM_TRANSPORT_FAILURE_REASON%, and the response-body behavior can be reverted with envoy.reloadable_features.hide_transport_failure_reason_in_response_body.
+ 1 more on the release page

Source ↗

Envoyv1.38.0Networking & MessagingApr 23, 2026

ACTION 1CHECK 6PLAN 1OTHER 77View full analysis

A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.

Action needed (1)

securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.

Check if affected (6)

securityURL encoding for query_parameter_mutations values
Applies if you configure query_parameter_mutations.
Query-parameter values added through query_parameter_mutations are now URL-encoded to prevent injection.
securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
RBAC handling was corrected to prevent concatenation-based bypasses.
breakingExplicit max_early_data_bytes configuration
Applies if you configure upstream_connect_mode with a value other than IMMEDIATE and do not configure max_early_data_bytes.
max_early_data_bytes must now be set explicitly when upstream_connect_mode has a value other than IMMEDIATE. Missing configuration causes validation to fail at startup.
+ 3 more on the release page

Plan ahead (1)

deprecatedThe enforce_rsa_key_usage option, deprecatedremoval date not announced
Applies if you configure enforce_rsa_key_usage.
The enforce_rsa_key_usage option is deprecated and will be removed in the next release.

Source ↗

Envoyv1.37.0Networking & MessagingJan 13, 2026

ACTION 1CHECK 2PLAN 1OTHER 30View full analysis

This release adds dynamic-module, filter, routing, observability, and certificate capabilities, along with fixes and performance improvements across HTTP, networking, and protocol handling. It also changes HTTP reset behavior, removes runtime guards and legacy code paths, and deprecates the OpenTelemetry access log common_config field.

Action needed (1)

breakingRuntime guards and legacy code paths removed
Multiple runtime guards and legacy code paths are removed in this release.

Check if affected (2)

breakingDefault HTTP reset code changed
Applicability is not stated in the release notes.
The default HTTP reset code changes from NO_ERROR to INTERNAL_ERROR.
breakingDefault upstream protocol error reset handling changed
Applicability is not stated in the release notes.
Reset handling now ignores upstream protocol errors by default.

Plan ahead (1)

deprecatedOpenTelemetry access log common_config field deprecated
Applies if you configure common_config.
The OpenTelemetry access log common_config field is deprecated in favor of explicit http_service or grpc_service configuration.

Source ↗

Browse by month