# Envoy v1.40.2

> Networking & Messaging · 2026-10-27

A security maintenance release updates the `distroless` image's CA bundle to stop trusting compromised eMudhra intermediate CAs. No other operator-facing changes are noted.

## Action needed
- **[security]** The `distroless` image's `ca-certificates` bundle
  - The `distroless` Docker image uses the patched `ca-certificates` package (`20250419+deb13u1`) and no longer trusts the roots of the compromised eMudhra intermediate CAs. The change ships in the `distroless` image; version 1.40.1 still contained the unpatched bundle.

[Full analysis](https://ratatosk.io/en/releases/envoy/v1.40.2)

[Original release notes](https://github.com/envoyproxy/envoy/releases/tag/v1.40.2)