# Envoy v1.39.2

> Networking & Messaging · 2026-10-01

A security and packaging release that fixes a remotely exploitable TLS denial of service and removes Debian bullseye packaging. It also refreshes the Ubuntu build and distroless Docker base images without noted runtime configuration changes.

## Action needed
- **[security · medium]** `CVE-2026-35189` TLS certificate parsing fix
  - `BoringSSL` was updated to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points. The fix addresses `CVE-2026-35189`, which could enable remote denial of service during TLS handshakes.

## Check if affected
- **[breaking]** Debian bullseye (11) packaging removal
  - Applies if you use Debian bullseye (11) packaging.
  - Debian bullseye (11) packaging was removed because bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.

## Other recorded changes
- 1 (value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.39.2)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.39.2)