v1.32.3

envoyproxy/envoyv1.32.3Dec 18, 2024by publish-envoy[bot]

AI Summary

This patch release addresses three critical security vulnerabilities (CVEs) related to Happy Eyeballs address validation and HTTP/1.1 handling to prevent crashes under specific load conditions.

Key Highlights

Fix CVE-2024-53269: Happy Eyeballs address validation
Fix CVE-2024-53270: HTTP/1 overload crash
Fix CVE-2024-53271: HTTP/1.1 multiple issues with balsa delay reset

Full Release Notes

- [CVE-2024-53269](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mfqp-7mmj-rm53): Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.
- [CVE-2024-53270](https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3):  HTTP/1: sending overload crashes when the request is reset beforehand
- [CVE-2024-53271](https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4f):  HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.32.3
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.32.3/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.32.3/version_history/v1.32/v1.32.3
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.32.2...v1.32.3

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>