# Contour v1.33.8

> Networking & Messaging · 2026-10-31

A security-focused maintenance release fixes three disclosed Contour vulnerabilities and updates dependencies for CVE fixes. It also includes Envoy and Go updates plus Kubernetes compatibility testing for versions 1.35 through 1.37.

## Action needed
- **[security]** Dependency updates for CVE fixes
  - Dependencies were updated to fix CVEs.

## Check if affected
- **[security]** GHSA-899w-6852-7fr3 crash loop for `Ingress` resource backends
  - Applies if an `Ingress` has a resource backend.
  - Fixes the crash loop described by GHSA-899w-6852-7fr3 when an `Ingress` has a resource backend.
- **[security]** GHSA-9x3c-68m7-f3x4 protection for `HTTPProxy` JWKS settings
  - Applies if one `HTTPProxy` uses the same JWKS host as another `HTTPProxy`.
  - Fixes GHSA-9x3c-68m7-f3x4, which allowed one `HTTPProxy` to replace the JWKS settings of another `HTTPProxy` using the same JWKS host.
- **[security]** GHSA-g6qh-g3pq-5cpm request matching for included `HTTPProxy` resources
  - Applies if an `HTTPProxy` is included and uses regex matching outside its prefix.
  - Fixes GHSA-g6qh-g3pq-5cpm, which allowed an included `HTTPProxy` to receive requests outside its prefix when regex was used.

## Other recorded changes
- 3 (value_changed 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/contour/v1.33.8)

[Original release notes](https://github.com/projectcontour/contour/releases/tag/v1.33.8)