# Emissary-Ingress v4.2.0

> Networking & Messaging · 2026-11-10

A security- and correctness-focused release changes internal API exposure, Envoy defaults, and configuration validation. It also includes routing, protocol, dependency, and chart updates, with behavior changes for deployments that rely on previously tolerated settings.

## Action needed
- **[security]** Trust for the eMudhra intermediate CAs removed
  - The image's CA bundle no longer trusts the compromised eMudhra intermediate CAs.
- **[security]** The `diagd` internal API is no longer reachable through admin port `8877`
  - The `diagd` internal API, including `POST /_internal/v0/watt`, is no longer reachable through the admin port `8877`.

## Check if affected
- **[security]** Latin-1 matching for `Mapping` regular expressions
  - Applies if you configure `prefix_regex`, `regex_headers`, or `regex_rewrite`.
  - Regular expressions in `Mapping`s, including `prefix_regex`, `regex_headers`, and `regex_rewrite`, are now matched in Latin-1 mode rather than UTF-8. This change is associated with `CVE-2026-73552`.
- **[security]** The `AMBASSADOR_DIAGD_BIND_PORT` and `AMBASSADOR_DIAGD_BIND_ADDREASS` variables removed
  - Applies if you configure `AMBASSADOR_DIAGD_BIND_PORT` or `AMBASSADOR_DIAGD_BIND_ADDREASS`.
  - The `AMBASSADOR_DIAGD_BIND_PORT` and `AMBASSADOR_DIAGD_BIND_ADDREASS` environment variables are removed because they no longer configure anything.
- **[security]** The unsanitized snapshot server removed
  - Applies if you use `kubectl port-forward` to reach the snapshot server.
  - The snapshot server that listened on `localhost:9696` is removed. It served the unsanitized snapshot, including secrets, and was reachable with `kubectl port-forward`.
- **[breaking]** Envoy worker-thread sizing by cgroup CPU limit
  - Applies if you do not set `ENVOY_CONCURRENCY`.
  - When `ENVOY_CONCURRENCY` is not set, Envoy sizes its worker threads to the container's cgroup CPU limit instead of the node's CPU count.
- **[breaking]** `X25519MLKEM768` added to default TLS ECDH curves
  - Applies if you do not set `ecdh_curves`.
  - `X25519MLKEM768` is now one of the default TLS ECDH curves for `Host`s and `TLSContext`s that do not set `ecdh_curves`.
- **[breaking]** The `error_response_overrides` mechanism disabled
  - Applies if you configure `error_response_overrides`.
  - The Ambassador Labs `error_response_overrides` mechanism is disabled. Attempts to use it now produce an error.
- **[breaking]** Lookups constrained to the named `datacenter`
  - Applies if you configure `datacenter`.
  - Lookups now query the named datacenter. A wrong `datacenter` value that previously happened to work will stop resolving.
- **[breaking]** Conflicting `hostPort` values for a `targetPort` rejected
  - Applies if you configure `hostPort` and `targetPort`.
  - Different `hostPort` values for the same `targetPort` are now rejected.

## Other recorded changes
- 13 (defect_corrected 6, value_changed 4, added 2, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/emissary-ingress/v4.2.0)

[Original release notes](https://github.com/emissary-ingress/emissary/releases/tag/v4.2.0)