v1.40.1
2026-10-23T08:52:16Z•3fbacf2a0d1d7aba48d075cd6bfada8f2d5a902a5e92acd7ae92468f16c2310f
CVE-2026-54786DNS-over-HTTPSDNS-over-TLSDockerEnvoyEnvoy MobilePKITLSWasmWasmtimecertificate-authority-compromiseeMudhraproxyrace-conditionsecurity-update
What happened
Envoy releases v1.37.9 through v1.40.1 include security updates for CVE-2026-54786 in the Wasm runtime by upgrading Wasmtime to 24.0.10, along with remediation for the eMudhra intermediate CA compromise. Updated Docker images, Envoy Mobile trust stores, and Hickory DNS TLS/HTTPS root bundles no longer trust affected eMudhra certificate authorities. Releases also contain concurrency, dynamic module, configuration, and metrics fixes.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- envoyproxy_envoy_releases
- Record identifier
- 3fbacf2a0d1d7aba48d075cd6bfada8f2d5a902a5e92acd7ae92468f16c2310f
- Enrichment time
- 2026-10-23T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.