# Envoy v1.39.6

> Networking & Messaging · 2026-10-27

A security maintenance release updates the `distroless` image's CA bundle. It stops the image from trusting compromised eMudhra intermediate CAs.

## Action needed
- **[security]** Patched CA bundle in the `distroless` Docker image
  - The `distroless` Docker image now uses the patched `ca-certificates` package (`20250419+deb13u1`) and no longer trusts the roots of the compromised eMudhra intermediate CAs. The update ships in the image released with this version.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.39.6)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.39.6)