v1.36.11
envoyproxy/envoyv1.36.11Oct 1, 2026by publish-envoy[bot]
Upgrading?
AI Summary
Addresses a critical security vulnerability (CVE-2026-35189) by patching BoringSSL to fix excessive memory allocation during TLS handshakes. Deprecated Debian Bullseye packaging due to end-of-life.
Key Highlights
- Fixed CVE-2026-35189 to prevent remote DoS during TLS handshakes
- Removed Debian Bullseye (11) packaging due to end-of-life
Breaking Changes
- Debian Bullseye (11) packaging has been removed
Full Release Notes
**Summary of changes**:
* Security fixes:
- [CVE-2026-35189](https://github.com/google/boringssl/blob/main/docs/advisories/2026-09-29.md): tls: patched BoringSSL to fix excessive memory allocation when parsing certificates with `nameRelativeToCRLIssuer` CRL Distribution Points, which could be exploited for remote denial of service during TLS handshakes. Note that the FIPS build is not patched.
* Build/packaging:
- Removed Debian bullseye (11) packaging, as bullseye is end-of-life and its repositories are no longer available on the main Debian mirrors.
**Docker images**:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.11
**Docs**:
https://www.envoyproxy.io/docs/envoy/v1.36.11/
**Release notes**:
https://www.envoyproxy.io/docs/envoy/v1.36.11/version_history/v1.36/v1.36.11
**Full changelog**:
https://github.com/envoyproxy/envoy/compare/v1.36.10...v1.36.11
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>
Signed-off-by: Ryan Northey <ryan@synca.io>Related Repositories
ggml-org/llama.cpp★ 131,945
LLM inference in C/C++
LadybirdBrowser/ladybird★ 66,606
Truly independent web browser
ClickHouse/ClickHouse★ 50,528
ClickHouse® is a real-time analytics database management system
LizardByte/Sunshine★ 42,490
Self-hosted game stream host for Moonlight.
deskflow/deskflow★ 29,980
Share a single keyboard and mouse between multiple computers.