v1.38.2

mickael-kerjean/filestashv1.38.2Jun 10, 2026by publish-envoy[bot]

AI Summary

This release addresses a bug regarding RTDS runtime guard override removal and introduces two new HTTP/2 features for monitoring header statistics and enforcing cookie size limits.

Key Highlights

Fixed RTDS runtime guard override removal to properly restore the default process-wide value.
Added opt-in histograms for HTTP/2 header statistics, including entry count, map byte size, and cookie details.
Introduced a new runtime guard to limit the size of reassembled cookie headers.

New Features

HTTP/2 header statistics histograms (header-entry count, header-map byte size, cookie length, and count).
Runtime guard `envoy.reloadable_features.http2_max_cookies_size_in_kb` to limit cookie header size.

Full Release Notes

**Summary of changes**:

* Bug fixes:
  - runtime: fixed RTDS runtime guard override removal so deleting an override restores the process-wide runtime guard value to the default value.

* New features:
  - http2: added opt-in histograms for HTTP/2 header statistics, including header-entry count, header-map byte size, reassembled ``cookie`` header length, and individual ``cookie`` header count. Enable with ``envoy.reloadable_features.http2_record_histograms``; the histograms and runtime guard will be removed in a future Envoy release.
  - http2: added ``envoy.reloadable_features.http2_max_cookies_size_in_kb`` to limit the size of the reassembled ``cookie`` header. By default, no cookie-size limit is enforced.

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.2
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.38.2/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.38.2/version_history/v1.38/v1.38.2
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.38.1...v1.38.2

Signed-off-by: Ryan Northey <ryan@synca.io>
Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>