Starstruk Logo MarkStarstruk

v1.35.11

envoyproxy/envoyv1.35.11Jun 3, 2026by publish-envoy[bot]

AI Summary

This release includes security patches for the HPACK cookie-bomb and various OAuth2 timing issues. It introduces new features for managing memory usage in stats extensions and limits the number of stats stored per scope.

Key Highlights

  • Security fixes for HPACK cookie-bomb and OAuth2 timing side-channels.
  • New stats eviction feature to remove unused metrics periodically.
  • New limit on the number of stats stored in each stats scope.
  • Fixed shutdown race condition in load reports.
  • Applied nghttp2 CVE-2026-27135 patch.

New Features

  • Support to remove unused metrics from memory for extensions.
  • Support to limit the number of stats stored in each stats scope.

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2026-47774](https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8): http2: HTTP/2 streams are now reset if they violate the configured maximum header list size. Uncompressed cookies now count towards ``mutable_max_request_headers_kb`` and ``max_headers_count`` limits, protecting against an HPACK cookie-bomb that could cause excessive memory usage. This can be reverted with ``envoy.reloadable_features.http2_include_cookies_in_limits``.
  - oauth2: fixed a timing side-channel in HMAC verification that could leak HMAC secret validity.
  - oauth2: fixed a crash where AES-CBC decryption of token cookies could spuriously succeed (~1/256) on a secret mismatch, tripping a ``HeaderString`` validation assert.
  - CVE-2026-27135: http2: applied nghttp2 CVE-2026-27135 patch.

* Bug fixes:
  - load_report: fixed a shutdown race with ADS stream by introducing proper gRPC stream cleanup.

* New features:
  - stats: added support to remove unused metrics from memory for extensions that support evictable metrics, done periodically during metric flush using ``stats_eviction_interval``.
  - stats: added support to limit the number of stats stored in each stats scope in the stats library.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.35.11
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.35.11/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.35.11/version_history/v1.35/v1.35.11
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.35.10...v1.35.11
    
Signed-off-by: Jonh Wendell <jonh.wendell@redhat.com>
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Ryan Northey <ryan@synca.io>