Plan
active
Envoy v1.37.8: security fixes for oauth2 and api_key_auth crashes
- Platform/SRE — Plan: Two GHSA-classified crash vulnerabilities in Envoy’s oauth2 and api_key_auth filters can be triggered by CONNECT requests; no KEV listing or active exploitation reported, but any team running these filters in production should schedule an upgrade to v1.37.8 this sprint. Envoy 1.37 EOL is 2027-01-13, so the branch is still supported.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.