# Envoy v1.38.9

> Networking & Messaging · 2026-10-26

A focused security maintenance release updates the CA bundle in the `distroless` Docker image. The image no longer trusts the compromised eMudhra intermediate CA roots.

## Action needed
- **[security]** Patched CA bundle in the `distroless` Docker image
  - The `distroless` Docker image now uses Debian bookworm's patched `ca-certificates` package, version `20250419~deb12u2`. This removes trust in the compromised eMudhra intermediate CA roots; the `distroless` image in 1.38.8 still contained the unpatched bundle.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.38.9)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.38.9)