v1.36.7

envoyproxy/envoyv1.36.7Jun 4, 2026by publish-envoy[bot]

AI Summary

This release focuses on security hardening, specifically mitigating an HPACK cookie-bomb attack and fixing HMAC timing side-channel leaks in OAuth2. Additionally, it resolves a shutdown race condition affecting the ADS stream in load reporting.

Key Highlights

Protection against HPACK cookie-bomb memory exhaustion.
Fixed HMAC timing side-channel vulnerability.
Fixed AES-CBC decryption crash.
Applied nghttp2 CVE-2026-27135 patch.
Fixed gRPC stream cleanup race in load reports.

Full Release Notes

**Summary of changes**:

* Security fixes:
  - [CVE-2026-47774](https://github.com/envoyproxy/envoy/security/advisories/GHSA-22m2-hvr2-xqc8): http2: HTTP/2 streams are now reset if they violate the configured maximum header list size. Uncompressed cookies now count towards ``mutable_max_request_headers_kb`` and ``max_headers_count`` limits, protecting against an HPACK cookie-bomb that could cause excessive memory usage. This can be reverted with ``envoy.reloadable_features.http2_include_cookies_in_limits``.
  - oauth2: fixed a timing side-channel in HMAC verification that could leak HMAC secret validity.
  - oauth2: fixed a crash where AES-CBC decryption of token cookies could spuriously succeed (~1/256) on a secret mismatch, tripping a ``HeaderString`` validation assert.
  - CVE-2026-27135: http2: applied nghttp2 CVE-2026-27135 patch.

* Bug fixes:
  - load_report: fixed a shutdown race with ADS stream by introducing proper gRPC stream cleanup.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.36.7
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.36.7/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.36.7/version_history/v1.36/v1.36.7
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.36.6...v1.36.7
    
Signed-off-by: Jonh Wendell <jonh.wendell@redhat.com>
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Ryan Northey <ryan@synca.io>