v1.39.4

2026-10-13T08:52:16Z•c0b4b4329841b2e1e7cb089c9c4dcafec00a1184104312fd17be4f768a04d02e

CVE-2026-54786API key authenticationCONNECT requestsEnvoy ProxyOAuth2 filterWasmtimeWebAssemblydenial of servicerace conditionrelease notessecurity update

Open source link →

What happened

Envoy Proxy maintenance releases v1.39.3/v1.38.6/v1.37.8/v1.36.12 address denial-of-service crashes in the OAuth2 and API key authentication filters when processing CONNECT-style requests without a :path header. Subsequent releases v1.39.4, v1.38.7, v1.37.9, and v1.36.13 include additional fixes, including an upgrade to Wasmtime 24.0.10 resolving CVE-2026-54786, route-configuration and worker-thread race conditions, and Prometheus histogram bucket indexing errors.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID: envoyproxy_envoy_releases
Record identifier: c0b4b4329841b2e1e7cb089c9c4dcafec00a1184104312fd17be4f768a04d02e
Enrichment time: 2026-10-13T08:52:16Z
AI-assisted enrichment: Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

← Back to published records