# Envoy v1.39.1

> Networking & Messaging · 2026-08-27

A security-focused release with fixes across HTTP, URL normalization, authorization, QUIC, TLS, and extensibility. It also includes ordinary correctness fixes and memory-management fixes.

## Action needed
- **[security]** CVE-2026-73512, `http3` frame-sequence use-after-free
  - CVE-2026-73512 (GHSA-r6j2-mrm5-72mg) fixes a use-after-free in `http3` when a specifically timed sequence of HTTP/3 frames is received. The fix ships in Envoy v1.39.1.
- **[security]** CVE-2026-73513, `http2` trailers without `END_STREAM`
  - CVE-2026-73513 (GHSA-jjmm-fw8p-crpw) fixes abnormal process termination in `http2` when trailers arrive without the `END_STREAM` flag. The fix ships in Envoy v1.39.1.
- **[security]** CVE-2026-73547, `ext_authz` handling of pathless requests
  - CVE-2026-73547 (GHSA-87ph-jqwm-pg6r) fixes abnormal process termination in `ext_authz` for requests without a URI path, including `CONNECT` requests. The fix ships in Envoy v1.39.1.
- **[security]** CVE-2026-73550, `http2` limits for dropped `Host` headers
  - CVE-2026-73550 (GHSA-qgf6-qvhw-4hvh) makes dropped `Host` headers count toward `http2` request header map size and count limits. The change ships in Envoy v1.39.1 and can be reverted with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`.
- **[security]** CVE-2026-48521, HTTP/3 upstream protocol selection
  - CVE-2026-48521 (GHSA-5vff-j9p4-38j3) fixes abnormal process termination when the upstream protocol is selected through ALPN and the server uses HTTP/3. The fix ships in Envoy v1.39.1.

## Check if affected
- **[security]** CVE-2026-73511, per-segment URL path-parameter stripping
  - Applies if you use URL normalization and do not enable `envoy.reloadable_features.strip_path_parameters_per_segment`.
  - CVE-2026-73511 (GHSA-m745-gh6x-349x) changes URL normalization to strip path parameters from individual path segments according to RFC 3986 section 3.3. The change ships in Envoy v1.39.1 and can be reverted with `envoy.reloadable_features.strip_path_parameters_per_segment`.
- **[security]** CVE-2026-73546, sanitized `admin` HTML stat names
  - Applies if you use the `admin` subsystem and enable `envoy.reloadable_features.sanitize_html_stats_names`.
  - CVE-2026-73546 (GHSA-pv9h-4fxf-7vrg) sanitizes `admin` stat names before converting them to HTML. The fix ships in Envoy v1.39.1 and is guarded by `envoy.reloadable_features.sanitize_html_stats_names`.
- **[security]** CVE-2026-73548, generic HTTP upgrade request-body handling
  - Applies if you use HTTP and do not enable `envoy.reloadable_features.http_pause_generic_upgrade_request_body`.
  - CVE-2026-73548 (GHSA-3vhp-c83q-jqc2) prevents payload sent before a generic HTTP upgrade is accepted from being interpreted as a pipelined HTTP/1 request and poisoning a shared upstream connection. The change ships in Envoy v1.39.1 and can be reverted with `envoy.reloadable_features.http_pause_generic_upgrade_request_body`.
- **[security]** CVE-2026-73549, scoped IPv6 addresses in QUIC
  - Applies if you use QUIC client connections or Original Dst clusters.
  - CVE-2026-73549 (GHSA-jp5f-qr64-c9vw) fixes a crash when handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters. The fix ships in Envoy v1.39.1.
- **[security]** CVE-2026-73551, parameter stripping from dot segments
  - Applies if `normalize_path` is configured and you do not enable `envoy.reloadable_features.strip_dotdot_segments_with_parameters`.
  - CVE-2026-73551 (GHSA-2w8w-rfw7-8gg4) strips path parameters from dot and dotdot segments such as `/.;` and `/..;`, so path canonicalization interprets them correctly. The fix ships in Envoy v1.39.1 when `normalize_path` is enabled, and can be reverted with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`.
- **[security]** CVE-2026-73552, Latin1 charset mode for `safe_regex`
  - Applies if you use `safe_regex` and do not enable `envoy.reloadable_features.re2_use_latin1_mode`.
  - CVE-2026-73552 (GHSA-23xh-2qxr-3xv8) changes `safe_regex` charset mode from UTF-8 to Latin1 because HTTP headers are not UTF-8 encoded. The change ships in Envoy v1.39.1 and can be reverted with `envoy.reloadable_features.re2_use_latin1_mode`.
- **[security]** CVE-2026-73553, RBAC path matching with ignored parameters
  - Applies if you use `rbac`, configure `ignore_path_parameters_in_path_matching`, and do not enable `envoy.reloadable_features.rbac_respect_ignore_path_parameters`.
  - CVE-2026-73553 (GHSA-77x5-xqjg-hprq) makes RBAC path matching respect the route's `ignore_path_parameters_in_path_matching`, preventing authorization bypass through appended path parameters. The fix ships in Envoy v1.39.1 and can be reverted with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`.
- **[security]** CVE-2026-50572, HTTP `ext_authz` rejection handling
  - Applies if you use `ext_authz` and HTTP.
  - CVE-2026-50572 (GHSA-q8wp-gf7q-m8cv) fixes a use-after-free when `ext_authz` over HTTP causes a request to be rejected. The fix ships in Envoy v1.39.1.

## Other recorded changes
- 4 (defect_corrected 4)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.39.1)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.39.1)