v1.39.3
2026-10-07T08:52:16Z•94276c4a04dc77e063eb3f176627161141f9417f7d90c4ea78295597b513aa51
CVE-2026-35189API key authenticationBoringSSLCONNECT requestsEnvoy ProxyHTTP/2OAuth2 filterTLS certificate parsingdenial of servicepatch availableremote denial of servicesecurity advisorysecurity release
What happened
Envoy Proxy security releases v1.39.3, v1.38.6, v1.37.8, and v1.36.12 address two unauthenticated denial-of-service crash conditions in the OAuth2 and API key authentication filters when processing CONNECT-style requests without a :path header. Earlier releases v1.39.2, v1.38.5, v1.37.7, and v1.36.11 address CVE-2026-35189 in bundled BoringSSL, preventing excessive memory allocation during TLS certificate parsing that could enable remote denial of service. BoringSSL FIPS builds are noted as unpatched for this issue.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- envoyproxy_envoy_releases
- Record identifier
- 94276c4a04dc77e063eb3f176627161141f9417f7d90c4ea78295597b513aa51
- Enrichment time
- 2026-10-07T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.