Starstruk Logo MarkStarstruk

v1.35.9

envoyproxy/envoyv1.35.9Mar 10, 2026by publish-envoy[bot]

AI Summary

This release addresses critical security vulnerabilities including a multivalue header bypass in RBAC, a crash in IPv6 address handling, and a JSON buffer overflow. It also includes a bug fix for OAuth2 host rewriting and migration of the googleurl dependency to a GitHub repository.

Key Highlights

  • Fixes multivalue header bypass in RBAC (CVE-2026-26308)
  • Fixes crash in getAddressWithPort() for scoped IPv6 addresses (CVE-2026-26310)
  • Fixes JSON off-by-one write that could corrupt string null terminator (CVE-2026-26309)
  • Fixes OAuth2 refresh requests to preserve original Host value
  • Migrates googleurl source to GitHub (google/gurl)

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2026-26308](https://github.com/envoyproxy/envoy/security/advisories/GHSA-ghc4-35x6-crw5): fix multivalue header bypass in rbac
  - [CVE-2026-26310](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3cw6-2j68-868p): network: fix crash in getAddressWithPort() when called with a scoped IPv6 address
  - [CVE-2026-26309](https://github.com/envoyproxy/envoy/security/advisories/GHSA-56cj-wgg3-x943): json: fixed an off-by-one write that could corrupted the string null terminator
  - [CVE-2026-26311](https://github.com/envoyproxy/envoy/security/advisories/GHSA-84xm-r438-86px): http: ensure decode* methods are blocked after a downstream reset

* Bug fix:
  - Fixed OAuth2 refresh requests so host rewriting no longer overrides the original Host value.

* Dependency updates:
  - Migrated googleurl source to GitHub (`google/gurl`).
  - Updated Kafka test binary to 3.9.2.
  - Updated Docker base images.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.35.9
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.35.9/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.35.9/version_history/v1.35/v1.35.9
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.35.8...v1.35.9

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>