Envoy: security advisories, deprecations and releases

Envoy v1.39.6 security fix for eMudhra CA compromise

Envoy v1.39.6 updates the distroless base image to patch ca-certificates and remove trust in compromised eMudhra intermediate CAs.

Envoy v1.40.2

Patch release updates the distroless docker image to a newer ca-certificates package, removing trust for compromised eMudhra intermediate CAs.

Envoy v1.37.11

Patch release updates the distroless Docker image with a patched ca-certificates package to remove trust in compromised eMudhra intermediate CA roots.

Envoy v1.38.9 security release patches eMudhra CA compromise

Envoy 1.38.9 updates the distroless Docker image with a patched ca-certificates package, removing trust for the compromised eMudhra intermediate CA roots that shipped in 1.38.8.

Envoy v1.37.10 security release removes compromised eMudhra CAs

Envoy v1.37.10 removes trust for compromised eMudhra intermediate CAs in Docker images and removes AAA Certificate Services and emSign ECC Root CA from Envoy Mobile root bundle.

Envoy v1.38.8

Patch release removes trust for compromised eMudhra intermediate CAs in Docker images, Envoy Mobile, and the built-in DNS resolver.

Envoy 1.40.0 fixes multiple CVEs and security issues

Addresses 10+ CVEs including HTTP/2, HTTP/3, ext_authz, OAuth2 and RBAC vulnerabilities.

CVE-2026-73505 CVE-2026-73511 CVE-2026-73512 CVE-2026-73513 CVE-2026-73546 CVE-2026-73547 CVE-2026-73548 CVE-2026-73550 CVE-2026-73551 CVE-2026-73552 CVE-2026-73553

Envoy v1.39.3 released with two security fixes

Envoy v1.39.3 fixes crashes in oauth2 and api_key_auth filters when handling CONNECT requests missing the :path header.

Envoy v1.38.6 security fixes for CONNECT requests

Patch addresses two crashes when handling CONNECT requests that lack a :path header in oauth2 and api_key_auth filters.

Envoy v1.36.12

Security fixes for two crashes triggered by CONNECT requests lacking a :path header when oauth2 or api_key_auth filters are enabled.

Envoy v1.37.8

Patch release fixes two crashes triggered by CONNECT requests without :path headers in oauth2 and api_key_auth filters.

Envoy 1.38 reaches end of life on 2027-04-23

Envoy 1.38 reaches end of life on 2027-04-23, as listed by endoflife.date.

Envoy 1.37 reaches end of life on 2027-01-13

Envoy 1.37 reaches end of life on 2027-01-13, as listed by endoflife.date.

Envoy 1.36 has reached end of life

Envoy 1.36 reached end of life on 2026-10-14, as listed by endoflife.date.

Envoy 1.37 reaches end of life on 2027-01-13

Envoy 1.37 reaches end of life on 2027-01-13, as listed by endoflife.date.

Envoy 1.36 reaches end of life on 2026-10-14

Envoy 1.36 reaches end of life on 2026-10-14, as listed by endoflife.date.

Envoy Proxy v1.39.5 released

Patch release includes upstream security fixes, behavior changes, and updated documentation for the Envoy proxy.

Envoy v1.40.1 released

Patch release v1.40.1 of the Envoy proxy is available, including upstream security fixes.

Envoy 1.40 released

Envoy 1.40 was released on 2026-10-13.

Envoy v1.39.4 patch release fixes RDS races and Prometheus histograms

Patch release fixing multiple race conditions that could destroy route-level configuration on worker threads during RDS updates, plus a Prometheus histogram index bug.

Envoy v1.37.9 released with security and race-condition fixes

Envoy v1.37.9 updates wasmtime to address CVE-2026-54786 and fixes races in AWS filters, local ratelimit, and SDS that could crash worker threads.

CVE-2026-54786

Envoy v1.38.7 released with security and bug fixes

Envoy 1.38.7 updates wasmtime to fix CVE-2026-54786, resolves multiple race conditions in route configuration handling, and corrects Prometheus histogram bucket indexing.

CVE-2026-54786

Envoy v1.36.13 released with upstream security fix

Envoy v1.36.13 ships a wasmtime bump fixing CVE-2026-54786 and several race-condition bug fixes in AWS filters, local rate limiting, and SDS.

CVE-2026-54786

Envoy v1.36.11 released

Patch release for Envoy proxy with security fixes and build updates.

Envoy v1.37.7 released

Envoy Proxy v1.37.7 is now available with security fixes and updated Docker images.

Envoy Proxy v1.38.5 released

Envoy Proxy version 1.38.5 is now available with security fixes, build and packaging updates.

Envoy v1.39.2 released

Patch release containing security fixes and build/packaging updates for Envoy proxy v1.39.2.