Plan
active
Envoy v1.39.3: security fixes for oauth2 and api_key_auth crashes
- Platform/SRE — Plan: Two GHSA-tracked crash vulnerabilities in the oauth2 and api_key_auth filters (triggered by CONNECT requests lacking a :path header) are patched in 1.39.3; no KEV listing or active exploitation reported, but operators using either filter should schedule the patch within the current sprint. Envoy 1.39 is supported until 2027-07-14.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.