v1.36.11 v1.37.7
envoyproxy/envoyOct 1, 2026 → Oct 1, 20260 days between releases
What's New
Includes same CVE fix as v1.36.11 but updates build infrastructure and removes Debian Bullseye support.
Breaking Changes
- Debian Bullseye (11) packaging has been removed.
Improvements
- Moved Debian release checksum signing into Bazel assembly to improve build consistency.
- Refreshed the Ubuntu build image to ensure compatibility.
Upgrade Notes
If you are using the FIPS build, this version does not include the CVE-2026-35189 patch. Ensure your deployment no longer relies on Debian Bullseye, which has been removed.
The Two Releases
v1.36.11
Oct 1, 2026· 21 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Deprecated Debian Bullseye packaging due to end-of-life.
Full release notesv1.37.7
Oct 1, 2026· 20 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Also deprecated Debian Bullseye packaging and updated build infrastructure.
Full release notes