1.37.10 (October 22, 2026)

Minor behavior changes

Changes that may cause incompatibilities for some users, but should not for most

• tls: Removed the AAA Certificate Services and emSign ECC Root CA - G3 roots from the root certificate bundle built into Envoy Mobile. Both roots issued or cross-signed eMudhra intermediate CA certificates whose private keys were compromised (see https://emudhra.we-have-a-problem.com/). Servers whose certificate chains only lead to these roots are no longer trusted by Envoy Mobile when it uses its built-in bundle.

Bug fixes

Changes expected to improve the state of the world and are unlikely to have negative effects

• release: Updated docker image to resolve the eMudhra Intermediate CA Compromise vulnerability.