v1.37.9
envoyproxy/envoyv1.37.9Oct 12, 2026by publish-envoy[bot]
Upgrading?
AI Summary
This release addresses a security vulnerability (CVE-2026-54786) by bumping the wasmtime dependency and resolves several race condition bugs in AWS, local rate limit, and SDS filters.
Key Highlights
- Resolved CVE-2026-54786 by bumping wasmtime to 24.0.10
- Fixed race condition in AWS request signing and Lambda filters
- Fixed race condition in local rate limit share provider manager
- Fixed race condition in SDS generic secret provider
Full Release Notes
**Summary of changes**:
* Upstream security fixes:
- CVE-2026-54786: wasm: bumped `wasmtime` to `24.0.10` to resolve
CVE-2026-54786.
* Bug fixes:
- aws: fixed a race where the route-level configuration of the AWS
request signing and AWS Lambda filters could be destroyed on a worker
thread when an RDS update replaced the route configuration.
- local_ratelimit: fixed a race where the share provider manager owned
by a local rate limit route-level configuration could be destroyed on a
worker thread.
- sds: fixed a race where a generic secret provider shared with worker
threads could be destroyed on a worker thread.
**Docker images**:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.9
**Docs**:
https://www.envoyproxy.io/docs/envoy/v1.37.9/
**Release notes**:
https://www.envoyproxy.io/docs/envoy/v1.37.9/version_history/v1.37/v1.37.9
**Full changelog**:
https://github.com/envoyproxy/envoy/compare/v1.37.8...v1.37.9
Signed-off-by: Jonh Wendell <jwendell@redhat.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
Related Repositories
ggml-org/llama.cpp★ 131,943
LLM inference in C/C++
LadybirdBrowser/ladybird★ 66,606
Truly independent web browser
ClickHouse/ClickHouse★ 50,528
ClickHouse® is a real-time analytics database management system
LizardByte/Sunshine★ 42,488
Self-hosted game stream host for Moonlight.
deskflow/deskflow★ 29,979
Share a single keyboard and mouse between multiple computers.