v1.37.2
2026-04-12T08:52:30Z•c5453d49f40c03c8a80d196a30bd91bf2a4f55dfc51c5481c15ffdadee16ae86
CVEaccess-logbuffercrashdockerdynamic-modulesenvoyinternal-redirectipv6jsonrate-limitrbacreleasesecurity
What happened
Envoy releases (v1.34.x → v1.37.2) that include multiple security fixes and stability/bug patches. Notable security advisories (published in v1.36.5 / v1.37.1 and backported to older branches) address: CVE-2026-26308 (RBAC multivalue header bypass), CVE-2026-26309 (JSON off‑by‑one write corrupting string terminator), CVE-2026-26310 (crash in getAddressWithPort() with scoped IPv6 addresses), CVE-2026-26311 (HTTP decode* methods not blocked after downstream reset), and CVE-2026-26330 (rate limit response-phase bug that may cause crashes). Later point releases (v1.37.2, v1.36.6, etc.) add fixes/fi
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- envoyproxy_envoy_releases
- Record identifier
- c5453d49f40c03c8a80d196a30bd91bf2a4f55dfc51c5481c15ffdadee16ae86
- Enrichment time
- 2026-04-12T08:52:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.