1.38.4 (August 26, 2026)

Minor behavior changes

Changes that may cause incompatibilities for some users, but should not for most

  • rbac: Fix: CVE-2026-73553

    RBAC path matching (via PathMatcher and UriTemplateMatcher) now respects the route’s ignore_path_parameters_in_path_matching configuration. When enabled on a route, the RBAC filter will strip path parameters (everything after a semicolon in each path segment, e.g., transforming /admin;x=y/action;foo=bar to /admin/action) before evaluating the path match. This ensures path matching consistency between the Router and the RBAC filter, preventing authorization bypasses where an attacker could append path parameters to bypass RBAC rules while still being routed to the protected endpoint.

    This behavioral change can be temporarily reverted by setting the runtime guard envoy.reloadable_features.rbac_respect_ignore_path_parameters to false.

Bug fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

  • ext_authz: Fix: CVE-2026-50572

    Fixed UAF when ext_authz over HTTP causes request to be rejected.

  • ext_authz: Fix: CVE-2026-73547

    Fixed abnormal process termination when Envoy calls ext_authz service with requests without URI path (i.e. CONNECT).

  • ext_proc: Fixed multiple lifetime bugs in the external processing (ext_proc) filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks. The gRPC async client now holds an optional reference to its stream callbacks and drops it once the stream is cleaned up or the owner detaches via waitForRemoteCloseAndDelete(), so a stream that outlives its callbacks (for example while awaiting remote close) no longer invokes callbacks on freed memory. Re-entrant resets during stream initialization are guarded so remote close is not notified (and the tracing span not finished) twice when the cluster is missing or stream creation fails synchronously, and half-close/cleanup no longer dereference a stream that was never established. The ext_proc ThreadLocalStreamManager and ProcessorStreamImpl now close any still-open streams on destruction to avoid dangling references into the underlying gRPC stream.

  • html: Fix: CVE-2026-73546

    Sanitize stat names before converting them to HTML. The change is guarded by runtime guard envoy.reloadable_features.sanitize_html_stats_names.

  • http: Fix: CVE-2026-73548.

    Fixed a vulnerability where payload sent before a generic HTTP upgrade was accepted could be interpreted as a pipelined HTTP/1 request and poison a shared upstream connection. Generic upgrade payload is now paused until the upstream accepts the upgrade. This change can be temporarily reverted by setting envoy.reloadable_features.http_pause_generic_upgrade_request_body to false.

  • http: Fixed a request/response body data-loss bug in the HTTP filter manager. When a filter stopped iteration on headers (for example a wasm filter with allow_on_headers_stop_iteration, which maps to a single-iteration stop rather than StopAllIterationAndWatermark), resumed asynchronously, and then on a subsequent body frame moved that frame into the filter-manager buffer via addDecodedData()/addEncodedData() before returning Continue, the now-empty frame was forwarded down the chain and the buffered bytes were silently dropped. This corrupted large streamed request bodies (for example one 16 KiB chunk lost when chained with an ext_proc filter in FULL_DUPLEX_STREAMED mode). The just-buffered data is now forwarded instead of the empty frame. This behavioral change can be reverted by setting the runtime guard envoy.reloadable_features.filter_manager_forward_added_data_on_continue to false.

  • http2: Fix: CVE-2026-73513

    Fixed abnormal process termination when Envoy receives trailers without the END_STREAM flag over HTTP/2 protocol.

  • http2: Fixes CVE-2026-73550

    Account for the length of dropped Host headers in HTTP/2 request header map size and count limits. Host headers are dropped when they match HTTP/2 `:authority header.

    This behavioral change can be reverted by setting the runtime guard envoy.reloadable_features.http2_track_size_of_dropped_host_header to false.

  • http3: Fix: CVE-2026-48521

    Fixed abnormal process termination when Envoy is configured to automatically select a protocol with upstream server based on ALPN and the server uses HTTP/3.

  • http3: Fix: CVE-2026-73512

    Fixed UAF when Envoy receives specifically timed sequence of HTTP/3 frames.

  • quic: Fix: CVE-2026-73549

    Fixed a crash when handling scoped IPv6 addresses in QUIC client connection and Original Dst cluster.

  • router: Fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending. Pending lookups are now cleaned up on DFP load balancer teardown, and the router no longer resumes async completion through a stale cluster reference.

  • safe_regex: Fix CVE-2026-73552

    Switch safe_regex charset mode from UTF-8 to Latin1. HTTP headers are not UTF-8 encoded and must use Latin1 charset for regex expressions. This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.re2_use_latin1_mode to false.

  • tls: Fixed a bug where OpenSSL was using glibc’s allocator instead of tcmalloc. This resulted in OpenSSL operating on a completely separate heap, defeating tcmalloc’s performance benefits on the TLS hot path and making all OpenSSL allocations invisible to tcmalloc heap profiling and memory dumps.

  • tls: Fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() called SSL_get_peer_certificate() without freeing the returned reference. Each call leaked one X509 refcount, preventing the certificate and its sub-allocations from being freed when the connection closed, causing unbounded memory growth in certain deployments.

  • url_normalization: Fixes CVE-2026-73511

    Strip path parameters from individual path segments per https://datatracker.ietf.org/doc/html/rfc3986#section-3.3

    This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.strip_path_parameters_per_segment to false.

  • url_normalization: Fixes CVE-2026-73551

    Strip URL path parameters from dot and dotdot segments (segments that start with /..; or /.;). This allows path canonicalization to interpret them correctly. Stripping of path parameters from dot and dotdot segments occurs only if the normalize_path configuration option is enabled.

    This behavioral change can be temporarily reverted by setting runtime guard envoy.reloadable_features.strip_dotdot_segments_with_parameters to false.