Plan
active
Envoy v1.38.6: security fixes for oauth2 and api_key_auth crashes
- Platform/SRE — Plan: Two crash-inducing security fixes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j) affect Envoy’s oauth2 and api_key_auth filters when handling CONNECT requests; no KEV listing or active exploitation reported, so schedule an upgrade to 1.38.6 this sprint if either filter is in use.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.