# Envoy v1.37.11

> Networking & Messaging · 2026-10-26

A targeted security maintenance release updates the CA bundle in the `distroless` image. It removes trust in compromised eMudhra intermediate CAs by shipping Debian bookworm's patched `ca-certificates` package.

## Action needed
- **[security]** The `distroless` image's CA bundle
  - The `distroless` Docker image now uses Debian bookworm's patched `ca-certificates` package, version `20250419~deb12u2`. The updated bundle no longer trusts the roots of the compromised eMudhra intermediate CAs; the `distroless` image in 1.37.10 still contained the unpatched bundle.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.37.11)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.11)