v1.40.2

2026-10-27T08:52:15Z•81ff01aa86bcf8b5a03b326b6cf27cc43ff7a81689d923fee972b4277c3ec0ca

DNS-over-HTTPSDNS-over-TLSDockerEnvoyEnvoy MobileTLScertificate-authority-compromisedistrolesseMudhrasecurity-updatetrust-store

Open source link →

What happened

Envoy releases 1.37.10 through 1.40.2 address the eMudhra intermediate CA compromise by removing compromised eMudhra trust anchors from Envoy Docker images, Envoy Mobile bundles, and built-in Hickory DNS-over-TLS/HTTPS trust stores. Follow-up releases update distroless image bases with patched Debian ca-certificates packages. No CVE identifier is provided in the release notes.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: envoyproxy_envoy_releases
Record identifier: 81ff01aa86bcf8b5a03b326b6cf27cc43ff7a81689d923fee972b4277c3ec0ca
Enrichment time: 2026-10-27T08:52:15Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records