v1.31.5

envoyproxy/envoyv1.31.5Dec 18, 2024by publish-envoy[bot]

AI Summary

This release includes critical security fixes for Happy Eyeballs address validation and HTTP/1.1 handling to prevent runtime crashes and undefined behavior.

Key Highlights

Fix CVE-2024-53269: Happy Eyeballs address validation
Fix CVE-2024-53270: HTTP/1 overload crash
Fix CVE-2024-53271: HTTP/1.1 multiple issues with balsa delay reset

Full Release Notes

**Summary of changes**:

- [CVE-2024-53269](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mfqp-7mmj-rm53): Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.
- [CVE-2024-53270](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3):  HTTP/1: sending overload crashes when the request is reset beforehand
- [CVE-2024-53271](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4f):  HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.31.5
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.31.5/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.31.5/version_history/v1.31/v1.31.5
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.31.4...v1.31.5

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>