# Envoy v1.37.7

> Networking & Messaging · 2026-10-01

A maintenance release with a BoringSSL fix for remote denial of service during TLS handshakes and the removal of Debian bullseye packaging. The fix does not apply to FIPS BoringSSL builds.

## Action needed
- **[breaking]** Debian bullseye (11) packaging removal
  - Debian bullseye (11) packaging was removed because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

## Check if affected
- **[security · medium]** CVE-2026-35189 `BoringSSL` certificate parsing fix
  - Applies if you do not use the `BoringSSL` FIPS build (`--define boringssl=fips`).
  - `BoringSSL` was patched to prevent excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points. The issue could permit remote denial of service during TLS handshakes, and the `BoringSSL` FIPS build (`--define boringssl=fips`) does not receive this patch.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.37.7)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.37.7)