v1.39.2
2026-10-02T08:52:15Z•c278fc3cdfb26c5cbae143440331448f47c39654011b231c58f6df330a9e1c1b
CVE-2026-35189BoringSSLCRL-distribution-pointsDebianEnvoyFIPS-buildTLScertificate-parsingmemory-exhaustionremote-denial-of-servicesecurity-releasesoftware-update
What happened
Envoy proxy maintenance releases v1.39.2, v1.38.5, v1.37.7, and v1.36.11 address CVE-2026-35189 in the bundled BoringSSL TLS implementation. Malformed certificates containing nameRelativeToCRLIssuer CRL Distribution Points could trigger excessive memory allocation and remotely cause denial of service during TLS handshakes. The releases also remove Debian bullseye packaging and update build, signing, and container images. The vulnerability is not fixed in the identified BoringSSL FIPS build variants, so affected deployments should verify their build configuration and upgrade or apply the vendor
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- envoyproxy_envoy_releases
- Record identifier
- c278fc3cdfb26c5cbae143440331448f47c39654011b231c58f6df330a9e1c1b
- Enrichment time
- 2026-10-02T08:52:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.