v1.36.5

Official Envoy changelog summary with source attribution, release tags, and community reactions.

Track this Envoy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Envoy·6 months ago · Mar 11, 2026, 12:36 AMFixSecurity-relevantAI-assisted summary

Summary

Security fixes for CVE-2026-26330, CVE-2026-26308, CVE-2026-26310, CVE-2026-26309, and CVE-2026-26311, addressing ratelimit crashes, RBAC header bypass, IPv6 address handling, JSON off‑by‑one write, and blocked HTTP decode after downstre...
Bug fix: OAuth2 refresh requests now preserve the original Host header instead of being overwritten by host rewriting.
Dependency updates: migrated googleurl source to GitHub, upgraded Kafka test binary to 3.9.2, and refreshed Docker base images.

securitybugfixminorsource healthy

Official source Last checked 14 hours ago

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked 14 hours ago

related channels

Turn this Envoy release note into a weekly digest for the tools you actually use.