v1.39.1 v1.36.11
high risk
envoyproxy/envoyAug 27, 2026 → Oct 1, 202635 days between releases
What's New
Removes Debian Bullseye packaging and patches BoringSSL to fix excessive memory allocation during TLS handshakes.
Breaking Changes
- Debian Bullseye (11) packaging has been removed
Improvements
- Patches BoringSSL to fix excessive memory allocation during TLS handshakes
Bug Fixes
- Fixed excessive memory allocation during TLS handshakes (CVE-2026-35189)
Upgrade Notes
If you are running on Debian Bullseye, you must switch to another distribution as the package is no longer available. The update mitigates a remote DoS vulnerability during TLS handshakes.
The Two Releases
v1.39.1
v1.39.1
Aug 27, 2026· 2 months ago
Continues security updates and TLS bug fixes, maintaining stability in HTTP/3, HTTP/2, and ext_proc components.
Full release notesv1.36.11
v1.36.11
Oct 1, 2026· 21 days ago
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Deprecated Debian Bullseye packaging due to end-of-life.
Full release notes