v1.37.7 v1.38.5
envoyproxy/envoyOct 1, 2026 → Oct 1, 20260 days between releases
What's New
v1.38.5 release notes describe identical changes to v1.37.7, including the CVE-2026-35189 fix and Debian Bullseye removal.
Upgrade Notes
The v1.38.5 release notes are identical to v1.37.7. No new configuration changes or migration steps are required.
The Two Releases
v1.37.7
Oct 1, 2026· 20 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Also deprecated Debian Bullseye packaging and updated build infrastructure.
Full release notesv1.38.5
Oct 1, 2026· 20 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Also deprecated Debian Bullseye packaging and updated build infrastructure.
Full release notes