tag: Envoy · 16 items
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, enabling potential MITM against any service trusting those CAs; upgrade Envoy to v1.40.1 now to remove trust in those CAs from the proxy trust store. If running Istio, also review the peer metadata label-fallback behavior change, which affects source_app/destination_app attribution in telemetry.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.40 EOL 2027-10-13
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Removes trust for compromised eMudhra CA private keys from Envoy’s trust store; any 1.37.x deployment trusting those CAs is exposed to fraudulent cert acceptance. No KEV listing or confirmed active exploitation, so cap is Plan — schedule patching to 1.37.10 this sprint; 1.37 itself EOLs 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 reaches EOL in 79d (2027-01-13)
- Platform/SRE — Plan: v1.40.0 changes mcp_router to stop forwarding downstream headers (including
authorization) to backends by default — a silent auth-breakage risk on upgrade. Audit MCP router configs and validate header_forwarding settings before rolling this out to any cluster. - CI/CD — Skip
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: Two GHSA-tracked crash vulnerabilities in the oauth2 and api_key_auth filters (triggered by CONNECT requests lacking a :path header) are patched in 1.39.3; no KEV listing or active exploitation reported, but operators using either filter should schedule the patch within the current sprint. Envoy 1.39 is supported until 2027-07-14.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Plan: Upgrade Envoy 1.38.x to 1.38.7 this quarter: it fixes a non-KEV/EPSS-0.00 CVE in wasmtime, several worker-thread race conditions during RDS route-config updates, and a 1.38.0-introduced regression that underreported Prometheus native histogram quantiles. No hard deadline; 1.38 EOL is 2027-04-23.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Two crash-inducing security fixes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j) affect Envoy’s oauth2 and api_key_auth filters when handling CONNECT requests; no KEV listing or active exploitation reported, so schedule an upgrade to 1.38.6 this sprint if either filter is in use.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Patch Envoy to 1.37.9 this quarter to resolve CVE-2026-54786 (not KEV-listed, EPSS 0.00) and three worker-thread race conditions in AWS request signing, local rate limiting, and SDS secret handling that could cause instability under RDS route updates; no forced deadline, 1.37 EOL is 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Two GHSA-classified crash vulnerabilities in Envoy’s oauth2 and api_key_auth filters can be triggered by CONNECT requests; no KEV listing or active exploitation reported, but any team running these filters in production should schedule an upgrade to v1.37.8 this sprint. Envoy 1.37 EOL is 2027-01-13, so the branch is still supported.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13
- Platform/SRE — Act: Envoy 1.36 reaches end-of-life on 2026-10-14 — apply v1.36.13 now (includes CVE-2026-54786 wasm fix and three race-condition fixes) and immediately begin upgrading to a supported Envoy minor version before that date.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.36 reaches EOL in 2d (2026-10-14) · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: CVE-2026-35189 fixes a remote DoS in TLS certificate parsing via BoringSSL; not KEV-listed and EPSS is near-zero, so no evidence of active exploitation — schedule an upgrade to v1.39.2 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14 · deprecation mentioned (no explicit date found) · CVE-2026-35189 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: v1.39.1 fixes multiple CVEs in Envoy’s HTTP/3 (UAF, CVE-2026-73512), HTTP/2 (process termination, CVE-2026-73513), and connection-handling paths — real data-plane exposure for any Istio, Contour, or Envoy-based ingress deployment. None are KEV-listed or confirmed exploited, so schedule patching this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Envoy is a common data-plane component in service meshes and ingress layers; this patch addresses a use-after-free in HTTP/3, process-termination bugs in HTTP/2, and multiple URL-normalization bypasses. No KEV listing or known active exploitation, so no hard deadline, but upgrade to v1.38.4 should be scheduled this sprint for any fleet running Envoy.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Nine CVEs addressed including a UAF on HTTP/3, abnormal process termination on HTTP/2 trailers and ext_authz CONNECT requests, and a shared upstream connection-poisoning bug via HTTP upgrade — none are KEV-listed but the severity warrants scheduling an upgrade to v1.37.6 this sprint for any cluster running Envoy as ingress or data-plane proxy.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-73511 — CISA KEV: not listed, EPSS n/a · CVE-2026-73512 — CISA KEV: not listed, EPSS n/a · CVE-2026-73513 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: v1.39.0 patches several CVEs across ext_authz, ext_proc, gRPC stats, and HTTP/2/HTTP/3 DoS vectors, but none are KEV-listed and EPSS is 0.00 — no hard deadline. Plan the upgrade this quarter, and validate the breaking TLS enforcement change and OpenTelemetry sampling behavior shift in staging before rolling to production.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · breaking-change flagged · CVE-2026-47204 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-47205 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-47207 — CISA KEV: not listed, EPSS 0.00