# Envoy v1.38.5

> Networking & Messaging · 2026-10-01

A security and packaging maintenance release with a BoringSSL fix for a remotely exploitable denial-of-service issue. It also removes Debian bullseye packaging and includes internal release-build updates.

## Action needed
- **[security · medium]** CVE-2026-35189 `BoringSSL` certificate parsing fix
  - This release patches `BoringSSL` to prevent excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could cause remote denial of service during TLS handshakes. The `BoringSSL` FIPS build using `--config=boringssl-fips` does not receive this patch.
- **[breaking]** Debian bullseye (11) packaging removal
  - This release removes `Debian bullseye (11)` packaging because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.5)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.5)