v1.38.5 v1.39.2
low risk
envoyproxy/envoyOct 1, 2026 → Oct 1, 20260 days between releases
What's New
Refreshed distroless base images alongside existing security and packaging updates.
Improvements
- Refreshed distroless base images
Upgrade Notes
No configuration changes are required; the distroless base image refresh is transparent to end users.
The Two Releases
v1.38.5
v1.38.5
Oct 1, 2026· 20 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Also deprecated Debian Bullseye packaging and updated build infrastructure.
Full release notesv1.39.2
v1.39.2
Oct 1, 2026· 20 days ago
This release updates BoringSSL to address a memory allocation denial-of-service vulnerability and updates build configurations by removing end-of-life Debian Bullseye support.
Full release notes