v1.36.4

envoyproxy/envoyv1.36.4Dec 10, 2025by publish-envoy[bot]

AI Summary

This release focuses on security updates to resolve dependency CVEs, specifically addressing a use-after-free vulnerability in the c-ares library that can cause crashes in cloud environments.

Key Highlights

Resolves c-ares/CVE-2025-0913 (use after free in DNS)
Addresses potential crash in cloud environments due to malfunctioning DNS
Limited exploitability as attacker requires control of DNS

Full Release Notes

**Summary of changes**:

* Security updates:

  Resolve dependency CVEs:
  - c-ares/CVE-2025-0913:
      Use after free can crash Envoy due to malfunctioning or compromised DNS.

While a potentially severe bug in some cloud environments, this has limited exploitability
as any attacker would require control of DNS.

Envoy advisory is here https://github.com/envoyproxy/envoy/security/advisories/GHSA-fg9g-pvc4-776f

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.4
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.36.4/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.36.4/version_history/v1.36/v1.36.4
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.36.3...v1.36.4

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Boteng Yao <boteng@google.com>