# Envoy v1.38.4

> Networking & Messaging · 2026-08-26

A security-focused maintenance release with vulnerability fixes across URL normalization, HTTP protocols, authorization, regular-expression handling, and QUIC. It also includes crash and memory-safety corrections, plus fixes for HTTP filter, external processing, routing, and TLS lifetime and allocation issues.

## Action needed
- **[security]** `CVE-2026-73511`, URL path-parameter normalization
  - This release changes URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The behavior can be reverted with `envoy.reloadable_features.strip_path_parameters_per_segment`.

## Check if affected
- **[security]** `CVE-2026-73512`, `http3` frame-sequence use-after-free
  - Applies if you run `http3`.
  - This release fixes a use-after-free in `http3` triggered by a specifically timed sequence of HTTP/3 frames.
- **[security]** `CVE-2026-73513`, `http2` trailers without END_STREAM
  - Applies if you run `http2`.
  - This release fixes abnormal process termination in `http2` when trailers arrive without the END_STREAM flag.
- **[security]** `CVE-2026-73546`, `admin` stat-name HTML sanitization
  - Applies if `envoy.reloadable_features.sanitize_html_stats_names` is enabled.
  - This release sanitizes `admin` stat names before converting them to HTML. The behavior is guarded by `envoy.reloadable_features.sanitize_html_stats_names`.
- **[security]** `CVE-2026-73547`, `ext_authz` requests without a URI path
  - Applies if you run `ext_authz`.
  - This release fixes abnormal process termination in `ext_authz` for requests without a URI path, including CONNECT requests.
- **[security]** `CVE-2026-73548`, generic HTTP upgrade request-body handling
  - Applies if you run `http`.
  - This release prevents payload sent before a generic HTTP upgrade is accepted from being interpreted as a pipelined HTTP/1 request that poisons a shared upstream connection. The behavior can be reverted with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`.
- **[security]** `CVE-2026-73549`, scoped IPv6 handling in `quic`
  - Applies if you run `quic`.
  - This release fixes a crash in `quic` client connections and Original Dst clusters when handling scoped IPv6 addresses.
- **[security]** `CVE-2026-73550`, dropped `Host` header accounting in `http2`
  - Applies if you run `http2`.
  - This release counts dropped `Host` headers toward request header map size and count limits in `http2`. The behavior can be reverted with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`.
- **[security]** `CVE-2026-73551`, dot-segment path-parameter normalization
  - Applies if `normalize_path` is enabled.
  - This release strips path parameters from dot and dotdot segments such as `/.;` and `/..;`, so URL canonicalization interprets them correctly. The behavior can be reverted with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`.
- **[security]** `CVE-2026-73552`, `safe_regex` Latin1 character-set mode
  - Applies if you run `safe_regex`.
  - This release changes `safe_regex` character-set mode from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The behavior can be reverted with `envoy.reloadable_features.re2_use_latin1_mode`.
- **[security]** `CVE-2026-73553`, `rbac` path-parameter matching
  - Applies if you run `rbac` and configure `ignore_path_parameters_in_path_matching`.
  - This release makes `rbac` path matching respect the route's `ignore_path_parameters_in_path_matching`, preventing authorization bypass through appended path parameters. The behavior can be reverted with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`.
- **[security]** `CVE-2026-50572`, HTTP `ext_authz` request-rejection use-after-free
  - Applies if you run `ext_authz`.
  - This release fixes a use-after-free in `ext_authz` over HTTP when a request is rejected.
- **[security]** `CVE-2026-48521`, ALPN-selected HTTP/3 upstream handling
  - Applies if you run `http3`.
  - This release fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3.

## Other recorded changes
- 5 (defect_corrected 5)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.4)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.4)