Plan active

Envoy v1.37.9: CVE-2026-54786 fix and worker-thread race conditions

2026-10-12 20:54 UTC · Releases: envoy · read the source ↗ #envoy #security #service-mesh

Platform/SRE — Plan: Patch Envoy to 1.37.9 this quarter to resolve CVE-2026-54786 (not KEV-listed, EPSS 0.00) and three worker-thread race conditions in AWS request signing, local rate limiting, and SDS secret handling that could cause instability under RDS route updates; no forced deadline, 1.37 EOL is 2027-01-13.
CI/CD — Skip
Leader — Skip
Signals: Envoy 1.37 EOL 2027-01-13 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00

This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.