v1.39.2
2026-10-03T08:52:16Z•7ece08e7a3b83169aa16a5f54019dff094f5e2b77fb7a731779dffdbbd43c207
CVE-2026-35189CVE-2026-73511CVE-2026-73512CVE-2026-73513CVE-2026-73546CVE-2026-73547CVE-2026-73548CVE-2026-73549CVE-2026-73550BoringSSLCRL Distribution PointsEnvoyHTTP request smugglingHTTP/2HTTP/3QUICTLScertificate parsingreleaseremote denial of servicesecurity updateuse-after-free
What happened
Envoy releases v1.39.2, v1.38.5, v1.37.7, and v1.36.11 address CVE-2026-35189 in the bundled BoringSSL, preventing excessive memory allocation while parsing certificates containing nameRelativeToCRLIssuer CRL Distribution Points. A remotely reachable attacker could exploit this during TLS handshakes to cause denial of service. Earlier patched releases also address multiple Envoy HTTP, HTTP/2, HTTP/3, QUIC, URL normalization, admin, and ext_authz vulnerabilities. FIPS BoringSSL builds are noted as not receiving the BoringSSL patch in several release branches.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- envoyproxy_envoy_releases
- Record identifier
- 7ece08e7a3b83169aa16a5f54019dff094f5e2b77fb7a731779dffdbbd43c207
- Enrichment time
- 2026-10-03T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.