Starstruk Logo MarkStarstruk

v1.38.1

Mail-0/Zerov1.38.1Jun 4, 2026by publish-envoy[bot]

AI Summary

This is a security-focused patch release for Envoy v1.38.1 addressing multiple vulnerabilities including CVEs related to HTTP/2 header list size limits and OAuth2 timing attacks. It also includes bug fixes for dynamic modules and minor behavior changes regarding upstream transport failure reasons.

Key Highlights

  • Fixes CVE-2026-47774: HTTP/2 streams reset if header list size is exceeded to prevent memory exhaustion (HPACK cookie-bomb).
  • Fixes OAuth2 timing side-channel in HMAC verification to prevent secret leakage.
  • Fixes OAuth2 crash during AES-CBC token cookie decryption.
  • Applies nghttp2 CVE-2026-27135 patch.
  • Removes upstream transport failure reason from HTTP response body (available in access logs).

New Features

  • Security hardening for HTTP/2 and OAuth2 protocols.

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2026-47774](https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8): http2: HTTP/2 streams are now reset if they violate the configured maximum header list size. Uncompressed cookies now count towards ``mutable_max_request_headers_kb`` and ``max_headers_count`` limits, protecting against an HPACK cookie-bomb that could cause excessive memory usage. This can be reverted with ``envoy.reloadable_features.http2_include_cookies_in_limits``.
  - oauth2: fixed a timing side-channel in HMAC verification that could leak HMAC secret validity.
  - oauth2: fixed a crash where AES-CBC decryption of token cookies could spuriously succeed (~1/256) on a secret mismatch, tripping a ``HeaderString`` validation assert.
  - CVE-2026-27135: http2: applied nghttp2 CVE-2026-27135 patch.

* Bug fixes:
  - dynamic_modules: fixed a crash in the HTTP filter when a stream was already above the downstream write-buffer high watermark at filter-chain construction time.

* Minor behavior changes:
  - router: the upstream transport failure reason is no longer included in the HTTP response body sent to downstream clients (still available in access logs via ``%UPSTREAM_TRANSPORT_FAILURE_REASON%``). Revert with ``envoy.reloadable_features.hide_transport_failure_reason_in_response_body``.
  - upstream: load balancer rebuild coalescing during EDS batch host updates is now opt-in. Re-enable with ``envoy.reloadable_features.coalesce_lb_rebuilds_on_batch_update``.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.1
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.38.1/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.38.1/version_history/v1.38/v1.38.1
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.38.0...v1.38.1
    
Signed-off-by: Jonh Wendell <jonh.wendell@redhat.com>
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Ryan Northey <ryan@synca.io>