# Envoy v1.36.11

> Networking & Messaging · 2026-10-01

A security-focused maintenance release fixes a remotely exploitable TLS denial-of-service issue in `BoringSSL`. Debian 11 packaging is no longer shipped, and the FIPS build remains unpatched for the TLS issue.

## Action needed
- **[security · medium]** `CVE-2026-35189` fixed in `BoringSSL`
  - `BoringSSL` is patched to prevent excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could enable remote denial of service during TLS handshakes. The FIPS build is not patched for this issue.
- **[breaking]** Debian `bullseye` (11) packaging removed
  - Packaging for Debian `bullseye` (11) was removed because the release is end-of-life and its repositories are no longer available on the main Debian mirrors.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.36.11)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.36.11)