Skip to content

chore(deps): update dependency envoy to v1.40.2 - #2665

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/envoy-1.x
Open

chore(deps): update dependency envoy to v1.40.2#2665
renovate[bot] wants to merge 1 commit into
developfrom
renovate/envoy-1.x

Conversation

@renovate

@renovate renovate Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
envoy minor 1.28.0 → 1.40.2

Release Notes

envoyproxy/envoy (envoy)

v1.40.2

Compare Source

Summary of changes:

  • Upstream security fixes:
    • eMudhra intermediate CA compromise:
      release: updated the distroless docker image base to pick up the patched
      ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the
      compromised eMudhra intermediate CAs. The distroless image released in 1.40.1 still
      shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.2
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.2/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.2/version_history/v1.40/v1.40.2
Full changelog:
envoyproxy/envoy@v1.40.1...v1.40.2

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.40.1

Compare Source

Summary of changes:

  • Upstream security fixes:

    • eMudhra intermediate CA compromise:
      the private keys of several eMudhra intermediate CA certificates were compromised.
      • release: updated the Envoy docker images so they no longer trust the compromised
        eMudhra CAs.
      • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
        from the root certificate bundle built into Envoy Mobile. Servers whose certificate
        chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
        its built-in bundle.
      • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
        built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
        trust the compromised eMudhra intermediate CAs.

  • Behavior changes:

    • contrib/istio: peer metadata conversion takes a peer's app name and version from the
      app and version labels again, falling back to app.kubernetes.io/name and
      app.kubernetes.io/version only when those are absent or empty. This makes peer-reported
      source_app, destination_app, source_version and destination_version match the
      values a workload reports for itself.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.1
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.1/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.1/version_history/v1.40/v1.40.1
Full changelog:
envoyproxy/envoy@v1.40.0...v1.40.1

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.40.0

Compare Source

Summary of changes

Breaking changes
  • build: Envoy has switched from WORKSPACE to bzlmod. The WORKSPACE file is removed; Envoy, the API and the docs are published as Bazel modules (envoy, envoy_api, envoy-docs). Downstreams must migrate to MODULE.bazel and must add Envoy's custom registry (https://raw.githubusercontent.com/envoyproxy/bazel-registry) alongside the BCR — many of Envoy's dependencies and patched modules are only published there.
  • build: the hermetic LLVM/Clang toolchain is bumped from 18 to 22. --config=clang and clang-local are removed — Clang/libc++ is now the default and needs no flag; GCC remains via --config=gcc. The --@envoy//bazel:libc++/libstdc++ flags and force_libcpp define are gone. Downstreams needing a host LLVM toolchain should follow bazel/tests/codeql.
  • build: the Wasm runtime is now selected with --@proxy-wasm-cpp-host//bazel:engine=<engine>; the old --define wasm=/--define engine= flags fail the build.
  • tls: AWS-LC is removed as a selectable SSL library (including --config=aws-lc-fips). ppc64le builds should use --config=openssl.
  • mcp_router: downstream request headers are no longer forwarded to backends by default — notably authorization. Use the new per-backend header_forwarding (forward_all: true restores the old behavior).
  • dynamic modules (Rust SDK): HttpFilter hooks now take &self rather than &mut self; per-stream mutable state must move behind interior mutability. This closes a use-after-free on synchronous filter-chain teardown.
Major changes
  • HTTP/3 and QUIC are now stable, including upstream HTTP/3 and all QUIC extensions. QUIC listeners gain client-certificate (mTLS) support, upstream QUIC gains client certificates, and P-384/P-521 ECDSA curves are supported.
  • Post-quantum by default: X25519MLKEM768 hybrid key exchange is added to the default ECDH curves for upstream and downstream TLS, including FIPS builds (revertible via envoy.reloadable_features.pqc_default_ecdh_curves).
  • Routing becomes extensible after match: new route_specifiers extension point post-processes (refines, drops, or synthesizes) the matched route at route-config, virtual-host and route level. A priority-group cluster specifier and a dynamic-module route specifier build on it.
  • Load balancing: new per_worker_subset policy decouples per-worker pool size from cluster size; new load_aware_locality policy picks localities by ORCA-derived headroom; coalesced LB rebuilds on EDS batch updates are now on by default.
  • Container-aware CPU detection is actually on by default — the 1.37 behaviour was only active with --cpuset-threads; it now applies whenever --concurrency is unset.
  • Drain is event-driven: drain-close decisions are pushed to connections when the drain starts rather than polled per response, which also fixes inbound-only drain for the Mongo/Redis/Thrift/generic proxies.
  • Hot restart for UDP: established UDP proxy sessions are kept by the parent while unknown-session datagrams are forwarded to the child, so connectionless listeners no longer go dark during drain.
AI / MCP
  • The AI Protocol Manager filter (alpha) gains response-side LLM token-usage extraction for OpenAI, Anthropic and Gemini dialects (SSE and JSON), published as typed dynamic metadata (envoy.data.ai.v3.TokenUsage), plus request-info, schema-validation and transcoding sub-filters and body re-serialization.
  • MCP filter: per-route config, protocol-version enforcement, required client capabilities, new method groups, no-op mode and early termination when routable. The JSON/REST bridge adds server discovery, header/protocol-version validation and result types, and now prevents path traversal via template variables.
Dynamic modules
  • New extension points: cluster specifier, route specifier, header formatter, early header mutation, TLS handshaker, transport-socket relay, config validator, and downstream STARTTLS.
  • Dynamic-module clusters can now delegate host selection to Envoy's built-in LBs (ROUND_ROBIN, LEAST_REQUEST, RANDOM, RING_HASH, MAGLEV).
  • Broad hardening: a large batch of lifetime/view fixes across HTTP, network, listener and cluster-LB filter state, deferred HTTP filter destroy, panic/exception barriers in the Go and C++ SDKs, re-entrancy fixes for callouts, and RTLD_NOW loading with logged load failures.
  • Typed metadata get/set, runtime getters, tracing spans across hooks, stream timing, upstream attempt/peer-address accessors, and Go SDK stats/log-level getters.
Security and auth
  • Carries forward the 1.39.x security fixes: URL normalization of path parameters (CVE-2026-73511/73551), HTTP/2 trailers-without-END_STREAM and dropped-Host accounting (CVE-2026-73513/73550), HTTP/3 UAF (CVE-2026-73512), ext_authz pathless-request crash and UAF (CVE-2026-73547/50572), generic-upgrade body pipelining (CVE-2026-73548), safe_regex Latin1 mode (CVE-2026-73552), RBAC ignore_path_parameters (CVE-2026-73553), admin stat-name sanitization (CVE-2026-73546), and the oauth2/api_key_auth CONNECT crashes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j), Out-of-Bounds Write in Brotli Decompressor (GHSA-3wvj-j6qm-62mr).
  • TLS: per-certificate TLS params, multiple upstream certificates with a certificate selector, SPIFFE upstream SAN validation, SDS file polling, and upstream session cache scoped by SNI.
  • OAuth2 gains assertion audience/key-id and TLS client auth for the credential injector; JWT auth gains claim paths and a JWT-claim rate-limit descriptor; GCP auth gains scopes, audiences and IAM access tokens; ext_authz gains shadow mode on the network filter and route-cache-clearing headers.
Observability
  • Access logs: downstream handshake time points and connection RTT, listener name and route-resolution-time formatters, CEL-expression formatter config, and nanosecond histogram units.
  • OpenTelemetry: resource detectors, custom exporters, instrumentation scope, and typed custom tags; ext_authz and ext_proc emit client spans.
  • Stats: per-cluster/listener stats matchers, explicit tags, and a fix for Prometheus native-histogram bucket indices being off by one.
Other notable changes
  • HTTP/1 now accepts the RFC 10008 QUERY method (revertible); QUERY without Content-Type is rejected on all protocols.
  • Redis proxy: RESP3 protocol support, CLUSTER SHARDS, stricter RESP decoding, and several use-after-free fixes.
  • Reverse tunnels: JWT handshake auth, maintain interval, fail-closed identifier validation, and a batch of handshake lifecycle fixes.
  • Watchdog backtrace action, UDP health checker, multi-health-checker, TCP proxy load-shed points, and a body-size-limit HTTP filter.
  • Fixed a family of races where route-level configuration (AWS signing, composite, filter chain, local ratelimit, dynamic modules, SDS secrets) could be destroyed on a worker thread after an RDS update.
Deprecations
  • envoy.extensions.config.validators factories keyed by type URL; dynamic-module log and timing-info callbacks; legacy HTTP filter factory base classes; reverse-tunnel auto_close_connections; Wasm plugin-level capability restriction.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.0
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.0/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Full changelog:
envoyproxy/envoy@v1.39.0...v1.40.0

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.6

Compare Source

Summary of changes:

  • Upstream security fixes:
    • eMudhra intermediate CA compromise:
      release: updated the distroless docker image base to pick up the patched
      ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the
      compromised eMudhra intermediate CAs. The distroless image released in 1.39.5 still
      shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.6
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.6/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.6/version_history/v1.39/v1.39.6
Full changelog:
envoyproxy/envoy@v1.39.5...v1.39.6

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.5

Compare Source

Summary of changes:

  • Upstream security fixes:

    • eMudhra intermediate CA compromise:
      the private keys of several eMudhra intermediate CA certificates were compromised.
      • release: updated the Envoy docker images so they no longer trust the compromised
        eMudhra CAs.
      • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
        from the root certificate bundle built into Envoy Mobile. Servers whose certificate
        chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
        its built-in bundle.
      • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
        built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
        trust the compromised eMudhra intermediate CAs.

  • Behavior changes:

    • contrib/istio: peer metadata conversion takes a peer's app name and version from the
      app and version labels again, falling back to app.kubernetes.io/name and
      app.kubernetes.io/version only when those are absent or empty. This makes peer-reported
      source_app, destination_app, source_version and destination_version match the
      values a workload reports for itself.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.5
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.5/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.5/version_history/v1.39/v1.39.5
Full changelog:
envoyproxy/envoy@v1.39.4...v1.39.5

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.4

Compare Source

Summary of changes:

  • Bug fixes:
  • aws: fixed a race where the route-level configuration of the AWS
    request signing and AWS Lambda filters could be destroyed on a worker
    thread when an RDS update replaced the route configuration.
  • composite: fixed a race where the route-level configuration of the
    composite filter could be destroyed on a worker thread when an RDS
    update replaced the route configuration.
  • dynamic_modules: fixed a bug where the per-route config destroy hook
    could run on a worker thread, and the module could be unloaded there,
    when an RDS update replaced the route configuration.
  • filter_chain: fixed a race where the route-level configuration of the
    filter chain filter could be destroyed on a worker thread when an RDS
    update replaced the route configuration.
  • local_ratelimit: fixed a race where the share provider manager owned
    by a local rate limit route-level configuration could be destroyed on a
    worker thread.
  • sds: fixed a race where a generic secret provider shared with worker
    threads could be destroyed on a worker thread.
  • stats: fixed a bug introduced in 1.38.0 that exported Prometheus
    native histogram bucket indices one bucket too low, causing consumers to
    decode observations into lower value ranges and underreport quantiles.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.4
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.4/
Release notes:

https://www.envoyproxy.io/docs/envoy/v1.39.4/version_history/v1.39/v1.39.4
Full changelog:
envoyproxy/envoy@v1.39.3...v1.39.4

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.3

Compare Source

Summary of changes:

  • Security fixes:
    • GHSA-8vc2-jrm4-835w:
      oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400.
    • GHSA-47vj-9r25-wv5j:
      api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source.
    • GHSA-3wvj-j6qm-62mr: Out-of-Bounds Write in Brotli Decompressor.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.3
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.3/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.3/version_history/v1.39/v1.39.3
Full changelog:
envoyproxy/envoy@v1.39.2...v1.39.3

Signed-off-by: wbpcode wbphub@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com

v1.39.2

Compare Source

Summary of changes:

  • Security fixes:

    • CVE-2026-35189: tls: updated BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes.

  • Build/packaging:

    • Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.
    • Moved Debian .changes and release checksum signing into the Bazel release assembly, with an audit of signing actions.
    • Refreshed the Ubuntu build and distroless Docker base images.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.2
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.2/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.2/version_history/v1.39/v1.39.2
Full changelog:
envoyproxy/envoy@v1.39.1...v1.39.2

Signed-off-by: Greg Greenway ggreenway@apple.com
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.1

Compare Source

Summary of changes:

  • Security fixes:

    • CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
    • CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames.
    • CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag.
    • CVE-2026-73546: admin: sanitize stat names before converting them to HTML. Guarded by envoy.reloadable_features.sanitize_html_stats_names.
    • CVE-2026-73547: ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT).
    • CVE-2026-73548: http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with envoy.reloadable_features.http_pause_generic_upgrade_request_body.
    • CVE-2026-73549: quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters.
    • CVE-2026-73550: http2: dropped Host headers now count towards request header map size and count limits. Revert with envoy.reloadable_features.http2_track_size_of_dropped_host_header.
    • CVE-2026-73551: url normalization: strip path parameters from dot and dotdot segments (/.;, /..;) so canonicalization interprets them correctly. Applies only when normalize_path is enabled; revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
    • CVE-2026-73552: safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with envoy.reloadable_features.re2_use_latin1_mode.
    • CVE-2026-73553: rbac: RBAC path matching now respects the route's ignore_path_parameters_in_path_matching, preventing authz bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.
    • CVE-2026-50572: ext_authz: UAF when ext_authz over HTTP causes a request to be rejected.
    • CVE-2026-48521: http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3.

  • Bug fixes:

    • http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
    • ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
    • tls: fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
    • tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.1
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.1/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.1/version_history/v1.39/v1.39.1
Full changelog:
envoyproxy/envoy@v1.39.0...v1.39.1

Signed-off-by: Yan Avlasov yavlasov@google.com
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Jonh Wendell jonh.wendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.39.0

Compare Source

Summary of changes

Breaking changes

  • build: Envoy now uses Bazel 8. Because Envoy still uses WORKSPACE mode, --enable_workspace and --noenable_bzlmod are required and have been added to .bazelrc; external-repository runfiles now appear directly under the runfiles root.
  • build: the Intel DLB connection balancer (envoy.network.connection_balance.dlb) is disabled for all builds due to a broken source archive.
  • TLS: enforce_rsa_key_usage is deprecated and ignored; Envoy now always enforces the certificate keyUsage extension.
  • TLS inspector: client TLS versions are validated and must be between TLS 1.0 and TLS 1.3 (revertible via envoy.reloadable_features.tls_inspector_enforce_client_tls_version).
  • OpenTelemetry tracing: the tracer now honors Envoy's request-entry sampling decision, including overall_sampling, even when propagated trace context or the configured sampler requests sampling. This may reduce exported spans.
Security
  • HTTP/2 now counts uncompressed cookies toward header-size and header-count limits (CVE-2026-47774), strengthens PRIORITY/WINDOW_UPDATE flood protection, and adds configurable nghttp2 RST_STREAM rate limits.
  • HTTP/3 fixes cover QPACK blocked-decoding denial of service (GHSA-p7c7-7c47-pwch) and inconsistent headers-only content-length handling (CVE-2026-48743).
  • Security fixes were added for ext_authz (CVE-2026-47205), ext_proc (CVE-2026-47207), gRPC stats (CVE-2026-47204), internal redirects (CVE-2026-47221), and OAuth2 lifecycle handling (CVE-2026-48090).
  • OAuth2 adds AES-256-GCM cookie encryption to address CVE-2026-47775. Migration is opt-in: enable oauth2_use_gcm_encryption, monitor oauth_legacy_cbc_decrypt, then disable oauth2_legacy_cbc_decrypt_compat.
  • Additional fixes cover DNS query validation (CVE-2026-48497), JSON nesting limits (CVE-2026-48042), PROXY protocol TLV smuggling (CVE-2026-47692), formatter crashes (CVE-2026-47220), TCP StatsD overflow (CVE-2026-48706), TLS SAN NUL handling (CVE-2026-47778), and Zstd decompression memory exhaustion (CVE-2026-48044).
  • New upstream RBAC and dynamic-forward-proxy resolved-address filtering provide CIDR-based protection against SSRF after DNS resolution and host selection.
Dynamic modules
  • New extension points: access-log/header formatters, downstream and upstream transport sockets, active health checkers, and stats sinks.
  • Cluster load balancers can read host stats, read and write dynamic metadata and filter state, and publish main-thread state to worker-local slots.
  • Modules can emit metrics from configuration and background contexts; loading and initialization failures now expose server-wide counters tagged by extension instance.
  • Added validation-mode detection, network/listener attribute access, batched header and metadata APIs, effective log-level access, and zero-copy borrowed buffers in the Rust SDK.
  • Fixed listener HTTP-callout crashes, watermark initialization, streaming-response re-entry, independent decode/encode continuation, CatchUnwind re-entry, Struct configuration handling, and HTTP/TCP bridge buffer overflow with more than 64 slices.
MCP (Model Context Protocol) and AI protocols
  • Added a Wuffs-backed streaming JSON parser for MCP, A2A, OpenAI, Anthropic, and related protocols, with bounded field capture, incremental parsing, no DOM allocation, and duplicate-key detection.
  • MCP filtering now exposes processing status, supports configurable duplicate-key rejection, and improves oversized-body behavior for pass-through and rejection modes.
  • MCP router adds elicitation and server-to-client request routing, plus lazy per-backend initialization.
  • MCP JSON REST Bridge adds per-route tool configuration and locally generated tools/list responses.
HTTP, routing and protocol
  • New HTTP filters provide weighted bandwidth sharing and selectable sub-filter chains with per-route configuration.
  • HeaderMatcher now evaluates separately supplied header values individually instead of matching only their comma-joined representation (revertible via envoy.reloadable_features.match_headers_individually).
  • HTTP inspector uses Balsa by default and now fast-fails invalid non-HTTP method bytes instead of buffering up to 64 KiB.
  • Added drain-timeout and maximum-connection-duration jitter to reduce synchronized reconnect spikes.
  • Routing gains cluster refresh on retries, weighted-cluster reselection, formatter/CEL-based redirect paths, and mixed literal/variable URI-template segments.
  • Fixed connection-pool re-entrancy, connectivity-grid teardown and duplicate-attempt bugs, stale on-demand cluster information, and handling of HTTP/2 or HTTP/3 RST_STREAM(NO_ERROR) after complete responses.
TLS, authentication and authorization
  • Added CNSA 1.0/2.0 compliance policies, TLS group formatters for identifying post-quantum key exchange, and suppression of oversized client CA lists.
  • QUIC supports opt-in TLS key logging and session-ticket resumption.
  • TLS certificate compression via the brotli runtime guard is disabled by default; TLS sockets also gain improved connection-reset reporting.
  • OAuth2 adds PRIVATE_KEY_JWT, ID-token forwarding, configurable post-logout redirects, access-token-based cookie lifetime, and safe original-request URI formatting with redirect-domain allowlists.
  • BasicAuth supports missing-credential pass-through and authenticated-username metadata; JWT extraction can mark forwarded claims whose signatures were not verified.
DNS, load balancing and upstream
  • The unified DNS cluster implementation is enabled by default; equivalent c-ares resolvers can be shared across clusters to support shared qcache.
  • DNS clusters gain a minimum TTL refresh floor, while dynamic forward proxy sub-clusters can use DnsCluster configuration and resolved-address CIDR filtering.
  • Client-side weighted round robin adds out-of-band ORCA reporting with configurable port, authority, and transport socket matching.
  • Least-request load balancing can optionally account for pending requests, with a new per-endpoint pending-request gauge.
  • Fixed EDS hostname updates, load reports containing only custom metrics or completed requests, and dynamic-forward-proxy lookup teardown.
Networking and system performance
  • Linux deployments gain worker CPU affinity and an SO_REUSEPORT BPF connection balancer for CPU-local connection steering.
  • Added a Linux sockmap socket interface for accelerating same-host TCP traffic through eBPF.
  • io_uring adds multishot receives, adaptive read buffers, and configurable write backpressure.
  • Reverse tunnels gain opt-in GOAWAY-aware draining and replacement; MySQL proxy adds downstream TLS termination with caching_sha2_password mediation.
  • Added UDP proxy external authorization, network ext_proc metadata reception, and early external-processor stream closure.
Observability
  • New access-log data includes upstream TLS SNI and HTTP/TCP downstream/upstream connection duration points; gRPC access logging adds delivery success/failure counters.
  • Added dynamic-module and Wasm programmable stats sinks, OpenTelemetry metric request chunking, endpoint observability names, and default-tag overrides.
  • Prometheus scraping and large-scale stat-reference release are substantially faster; /peak_heap_dump exposes tcmalloc's peak heap profile.
  • Added process-wide Lua and Wasm VM gauges, single-entry stack traces, and an Envoy-version log-format token.
  • Tap now honors configured runtime sampling and reports sampled-out requests/connections.
Rate limiting and configuration
  • Rate limiting adds static and dynamic per-descriptor limit overrides, zero-token always-reject behavior, and configurable response-metadata namespaces.
  • GCP authentication supports bound access tokens, bound JWTs, and unbound access tokens from the metadata server.
  • Added file-backed IP tagging, in-place watched-file modification events, runtime-adjustable fixed-heap limits, health-check HTTP status events, and xDS unsubscribe callbacks.
  • Redis proxy adds Redis 7.4 hash-field expiry commands and permits custom commands inside transactions.
Other notable changes and fixes
  • Fixed Hickory DNS resolver leaks and use-after-free, file-server cancellation use-after-free, Golang filter re-entry, outlier-detection teardown, missing network namespaces, and asynchronous TLS close handling.
  • Fixed RTDS guard removal, VHDS subscriptions, Wasm VM cache invalidation when environment variables change, and upstream Wasm metric scoping.
  • Improved UDP proxy attempted-host and address logging, Zipkin timestamp trace IDs, gRPC access-log failure accounting, and health-check event detail.
  • Added TCP proxy delayed route selection, drain-close handling, and connection-duration access logging.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.0
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.0/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.0/version_history/v1.39/v1.39.0
Full changelog:
envoyproxy/envoy@v1.38.0...v1.39.0

Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io
Signed-off-by: Jonh Wendell jwendell@redhat.com

v1.38.9

Compare Source

Summary of changes:

  • Upstream security fixes:
    • eMudhra intermediate CA compromise:
      release: the distroless docker image now uses the patched ca-certificates package
      (20250419~deb12u2) from Debian bookworm, so it no longer trusts the roots of the
      compromised eMudhra intermediate CAs. The distroless image released in 1.38.8 still
      shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.9
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.9/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.9/version_history/v1.38/v1.38.9
Full changelog:
envoyproxy/envoy@v1.38.8...v1.38.9

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.38.8

Compare Source

Summary of changes:

  • Upstream security fixes:
    • eMudhra intermediate CA compromise:
      the private keys of several eMudhra intermediate CA certificates were compromised.
      • release: updated the Envoy docker images so they no longer trust the compromised
        eMudhra CAs.
      • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
        from the root certificate bundle built into Envoy Mobile. Servers whose certificate
        chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
        its built-in bundle.
      • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
        built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
        trust the compromised eMudhra intermediate CAs.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.8
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.8/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.8/version_history/v1.38/v1.38.8
Full changelog:
envoyproxy/envoy@v1.38.7...v1.38.8

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.38.7

Compare Source

Summary of changes:

  • Upstream security fixes:
  • Bug fixes:
  • aws: fixed a race where the route-level configuration of the AWS
    request signing and AWS Lambda filters could be destroyed on a worker
    thread when an RDS update replaced the route configuration.
  • dynamic_modules: fixed a bug where the per-route config destroy hook
    could run on a worker thread, and the module could be unloaded there,
    when an RDS update replaced the route configuration.
  • local_ratelimit: fixed a race where the share provider manager owned
    by a local rate limit route-level configuration could be destroyed on a
    worker thread.
  • sds: fixed a race where a generic secret provider shared with worker
    threads could be destroyed on a worker thread.
  • stats: fixed a bug introduced in 1.38.0 that exported Prometheus
    native histogram bucket indices one bucket too low, causing consumers to
    decode observations into lower value ranges and underreport quantiles.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.7
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.7/
Release notes:

https://www.envoyproxy.io/docs/envoy/v1.38.7/version_history/v1.38/v1.38.7
Full changelog:
envoyproxy/envoy@v1.38.6...v1.38.7

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.38.6

Compare Source

Summary of changes:

  • Security fixes:
    • GHSA-8vc2-jrm4-835w:
      oauth2: crash on requests without a :path header (i.e. CONNECT). The filter now rejects such requests with 400.
    • GHSA-47vj-9r25-wv5j:
      api_key_auth: crash when hide_credentials is enabled with a query key source and a request without a :path header (i.e. CONNECT) is authenticated via another key source.
    • GHSA-3wvj-j6qm-62mr: Out-of-Bounds Write in Brotli Decompressor.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.6
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.6/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.6/version_history/v1.38/v1.38.6
Full changelog:
envoyproxy/envoy@v1.38.5...v1.38.6

Signed-off-by: wbpcode wbphub@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com

v1.38.5

Compare Source

Summary of changes:

  • Security fixes:

    • CVE-2026-35189: tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. The BoringSSL FIPS build (--config=boringssl-fips) does not receive this patch.

  • Build/packaging:

    • Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.
    • Moved Debian .changes and release checksum signing into the Bazel release assembly, with an audit of signing actions.
    • Refreshed the Ubuntu build image.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.5
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.5/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.5/version_history/v1.38/v1.38.5
Full changelog:
envoyproxy/envoy@v1.38.4...v1.38.5

Signed-off-by: Greg Greenway ggreenway@apple.com
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.38.4

Compare Source

Summary of changes:

  • Security fixes:

    • CVE-2026-73511: url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
    • CVE-2026-73512: http3: UAF on a specifically timed sequence of HTTP/3 frames.
    • CVE-2026-73513: http2: abnormal process termination on trailers received without the END_STREAM flag.
    • CVE-2026-73546: admin: sanitize stat names before converting them to HTML. Guarded by envoy.reloadable_features.sanitize_html_stats_names.
    • CVE-2026-73547: ext_authz: abnormal process termination on requests without a URI path (i.e. CONNECT).
    • CVE-2026-73548: http: payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Revert with envoy.reloadable_features.http_pause_generic_upgrade_request_body.
    • CVE-2026-73549: quic: crash handling scoped IPv6 addresses in QUIC client connections and Original Dst clusters.
    • CVE-2026-73550: http2: dropped Host headers now count towards request header map size and count limits. Revert with envoy.reloadable_features.http2_track_size_of_dropped_host_header.
    • CVE-2026-73551: url normalization: strip path parameters from dot and dotdot segments (/.;, /..;) so canonicalization interprets them correctly. Applies only when normalize_path is enabled; revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
    • CVE-2026-73552: safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with envoy.reloadable_features.re2_use_latin1_mode.
    • CVE-2026-73553: rbac: RBAC path matching now respects the route's ignore_path_parameters_in_path_matching, preventing authz bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.
    • CVE-2026-50572: ext_authz: UAF when ext_authz over HTTP causes a request to be rejected.
    • CVE-2026-48521: http3: abnormal process termination when upstream protocol is selected via ALPN and the server uses HTTP/3.

  • Bug fixes:

    • http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
    • ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
    • router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending.
    • tls: fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
    • tls: fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.4
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.4/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.4/version_history/v1.38/v1.38.4
Full changelog:
envoyproxy/envoy@v1.38.3...v1.38.4

Signed-off-by: Yan Avlasov yavlasov@google.com
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Jonh Wendell jonh.wendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

v1.38.3

Compare Source

Summary of changes:

  • Security fixes:

    • CVE-2026-47205: Authz per route crash
    • CVE-2026-47207: ext_proc response in one gRPC message
    • CVE-2026-47221: router internal redirects crash
    • CVE-2026-47220: REQUESTED_SERVER_NAME crash
    • CVE-2026-47775: OAuth2 code verifier padding oracle
    • CVE-2026-48044: zstd RLE zip bomb
    • CVE-2026-47204: grpc_stats filter segfault on Connect protocol requests to direct_response routes
    • CVE-2026-47692: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream
    • CVE-2026-47778: Embedded NUL in TLS SAN Truncation, Auth Bypass
    • CVE-2026-48042: Stack overflow in destructor of highly nested JSON
    • CVE-2026-48090: OAuth2 filter late async token completion after stream teardown results in UAF/crash risk
    • CVE-2026-48497: Abnormal process termination in DNS UDP filter
    • CVE-2026-48743: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length
    • CVE-2026-48706: Envoy Heap Buffer Overflow in TcpStatsdSink
    • GHSA-p7c7-7c47-pwch: Denial-of-Service Attack Against the HTTP/3 Stack via QPACK Blocked Decoding

  • Upstream security fixes:

  • Behavior changes:

    • build: disabled the contrib extension envoy.network.connection_balance.dlb (Intel DLB connection balancer) at the Bazel layer for all builds and platforms due to a breakage at the source archive. See #​45491 for local workarounds.

  • Minor behavior changes:

    • tls: runtime guard envoy.reloadable_features.tls_certificate_compression_brotli is now disabled by default. When disabled, QUIC retains zlib-only certificate compression and TCP TLS performs no certificate compression. It can be re-enabled by setting the runtime guard to true.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.3
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.3/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.3/version_history/v1.38/v1.38.3
Full changelog:
envoyproxy/envoy@v1.38.2...v1.38.3

Signed-off-by: Greg Greenway ggreenway@apple.com
Signed-off-by: Jonh Wendell jonh.wendell@redhat.com
Signed-off-by: Kateryna Nezdolii kateryna.nezdolii@gmail.com
Signed-off-by: Ryan Northey ryan@synca.io
Signed-off-by: Boteng Yao boteng@google.com

v1.38.2

Compare Source

Summary of changes:

  • Bug fixes:
    • runtime: fixed RTDS runtime guard

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner November 13, 2026 21:26
@renovate

renovate Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: ansible/vars.yml
Post-upgrade command 'nix run .#update-ansible-artifacts -- envoy 1.40.2' has not been added to the allowed list in allowedCommands

@github-actions

github-actions Bot commented Nov 13, 2026

Copy link
Copy Markdown

Package version diff

Compares built package versions in legacyPackages between this PR and the tip of the base branch, per system.

aarch64-linux: Closure size: 372 -> 372 (2 paths added, 2 paths removed, delta +0, disk usage +0B). 
<<< /nix/store/7h581c4y787wn5izszjrimnglyfavd0m-build-ami
>>> /nix/store/vcg6bg62rncc7rklw374hsfq18hg1bc9-build-ami
No version or selection state changes.
Closure size: 98 -> 98 (2 paths added, 2 paths removed, delta +0, disk usage +0B).
<<< /nix/store/336vykfaa7phiia5csbliai8g8ls9nv0-build-qemu-image
>>> /nix/store/2zz9hmh8gnjssmhgn1px4nl5wwjr91g6-build-qemu-image
No version or selection state changes.
Closure size: 372 -> 372 (2 paths added, 2 paths removed, delta +0, disk usage +0B).
x86_64-linux: Closure size: 370 -> 370 (2 paths added, 2 paths removed, delta +0, disk usage +0B). 
<<< /nix/store/5dgg2dlhva678vsdv6fsbg2s99c3qhms-build-ami
>>> /nix/store/j449x017nf183iagjgxzagm7j4qyg78r-build-ami
No version or selection state changes.
Closure size: 99 -> 99 (2 paths added, 2 paths removed, delta +0, disk usage +0B).
<<< /nix/store/p9r771kc3h2hl9nhw2hqczfr7qq342wm-build-qemu-image
>>> /nix/store/571y9f9axv37vs6rc1x833h3k8p3498h-build-qemu-image
No version or selection state changes.
Closure size: 370 -> 370 (2 paths added, 2 paths removed, delta +0, disk usage +0B).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants