Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    release: updated the distroless docker image base to pick up the patched
    ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the
    compromised eMudhra intermediate CAs. The distroless image released in 1.40.1 still
    shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.2
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.2/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.2/version_history/v1.40/v1.40.2
Full changelog:
v1.40.1...v1.40.2

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    release: updated the distroless docker image base to pick up the patched
    ca-certificates package (20250419+deb13u1), so it no longer trusts the roots of the
    compromised eMudhra intermediate CAs. The distroless image released in 1.39.5 still
    shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.6
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.6/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.6/version_history/v1.39/v1.39.6
Full changelog:
v1.39.5...v1.39.6

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    release: the distroless docker image now uses the patched ca-certificates package
    (20250419~deb12u2) from Debian bookworm, so it no longer trusts the roots of the
    compromised eMudhra intermediate CAs. The distroless image released in 1.38.8 still
    shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.9
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.9/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.9/version_history/v1.38/v1.38.9
Full changelog:
v1.38.8...v1.38.9

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    release: the distroless docker image now uses the patched ca-certificates package
    (20250419~deb12u2) from Debian bookworm, so it no longer trusts the roots of the
    compromised eMudhra intermediate CAs. The distroless image released in 1.37.10 still
    shipped the unpatched bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.11
Docs:
https://www.envoyproxy.io/docs/envoy/v1.37.11/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.37.11/version_history/v1.37/v1.37.11
Full changelog:
v1.37.10...v1.37.11

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:

  • eMudhra intermediate CA compromise:
    the private keys of several eMudhra intermediate CA certificates were compromised.
    • release: updated the Envoy docker images so they no longer trust the compromised
      eMudhra CAs.
    • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
      from the root certificate bundle built into Envoy Mobile. Servers whose certificate
      chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
      its built-in bundle.
    • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
      built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
      trust the compromised eMudhra intermediate CAs.

• Behavior changes:

  • contrib/istio: peer metadata conversion takes a peer's app name and version from the
    app and version labels again, falling back to app.kubernetes.io/name and
    app.kubernetes.io/version only when those are absent or empty. This makes peer-reported
    source_app, destination_app, source_version and destination_version match the
    values a workload reports for itself.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.1
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.1/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.1/version_history/v1.40/v1.40.1
Full changelog:
v1.40.0...v1.40.1

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:

  • eMudhra intermediate CA compromise:
    the private keys of several eMudhra intermediate CA certificates were compromised.
    • release: updated the Envoy docker images so they no longer trust the compromised
      eMudhra CAs.
    • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
      from the root certificate bundle built into Envoy Mobile. Servers whose certificate
      chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
      its built-in bundle.
    • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
      built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
      trust the compromised eMudhra intermediate CAs.

• Behavior changes:

  • contrib/istio: peer metadata conversion takes a peer's app name and version from the
    app and version labels again, falling back to app.kubernetes.io/name and
    app.kubernetes.io/version only when those are absent or empty. This makes peer-reported
    source_app, destination_app, source_version and destination_version match the
    values a workload reports for itself.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.5
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.5/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.39.5/version_history/v1.39/v1.39.5
Full changelog:
v1.39.4...v1.39.5

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    the private keys of several eMudhra intermediate CA certificates were compromised.
    • release: updated the Envoy docker images so they no longer trust the compromised
      eMudhra CAs.
    • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
      from the root certificate bundle built into Envoy Mobile. Servers whose certificate
      chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
      its built-in bundle.
    • dns_resolver: updated the webpki-roots and rustls-webpki crates used by the
      built-in Hickory DNS resolver, so DNS-over-TLS and DNS-over-HTTPS upstreams no longer
      trust the compromised eMudhra intermediate CAs.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.38.8
Docs:
https://www.envoyproxy.io/docs/envoy/v1.38.8/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.38.8/version_history/v1.38/v1.38.8
Full changelog:
v1.38.7...v1.38.8

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Upstream security fixes:
  • eMudhra intermediate CA compromise:
    the private keys of several eMudhra intermediate CA certificates were compromised.
    • release: updated the Envoy docker images so they no longer trust the compromised
      eMudhra CAs.
    • mobile: removed the AAA Certificate Services and emSign ECC Root CA - G3 roots
      from the root certificate bundle built into Envoy Mobile. Servers whose certificate
      chains only lead to these roots are no longer trusted by Envoy Mobile when it uses
      its built-in bundle.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.37.10
Docs:
https://www.envoyproxy.io/docs/envoy/v1.37.10/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.37.10/version_history/v1.37/v1.37.10
Full changelog:
v1.37.9...v1.37.10

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes

Breaking changes

• build: Envoy has switched from WORKSPACE to bzlmod. The WORKSPACE file is removed; Envoy, the API and the docs are published as Bazel modules (envoy, envoy_api, envoy-docs). Downstreams must migrate to MODULE.bazel and must add Envoy's custom registry (https://raw.githubusercontent.com/envoyproxy/bazel-registry) alongside the BCR — many of Envoy's dependencies and patched modules are only published there.
• build: the hermetic LLVM/Clang toolchain is bumped from 18 to 22. --config=clang and clang-local are removed — Clang/libc++ is now the default and needs no flag; GCC remains via --config=gcc. The --@envoy//bazel:libc++/libstdc++ flags and force_libcpp define are gone. Downstreams needing a host LLVM toolchain should follow bazel/tests/codeql.
• build: the Wasm runtime is now selected with --@proxy-wasm-cpp-host//bazel:engine=<engine>; the old --define wasm=/--define engine= flags fail the build.
• tls: AWS-LC is removed as a selectable SSL library (including --config=aws-lc-fips). ppc64le builds should use --config=openssl.
• mcp_router: downstream request headers are no longer forwarded to backends by default — notably authorization. Use the new per-backend header_forwarding (forward_all: true restores the old behavior).
• dynamic modules (Rust SDK): HttpFilter hooks now take &self rather than &mut self; per-stream mutable state must move behind interior mutability. This closes a use-after-free on synchronous filter-chain teardown.

Major changes

• HTTP/3 and QUIC are now stable, including upstream HTTP/3 and all QUIC extensions. QUIC listeners gain client-certificate (mTLS) support, upstream QUIC gains client certificates, and P-384/P-521 ECDSA curves are supported.
• Post-quantum by default: X25519MLKEM768 hybrid key exchange is added to the default ECDH curves for upstream and downstream TLS, including FIPS builds (revertible via envoy.reloadable_features.pqc_default_ecdh_curves).
• Routing becomes extensible after match: new route_specifiers extension point post-processes (refines, drops, or synthesizes) the matched route at route-config, virtual-host and route level. A priority-group cluster specifier and a dynamic-module route specifier build on it.
• Load balancing: new per_worker_subset policy decouples per-worker pool size from cluster size; new load_aware_locality policy picks localities by ORCA-derived headroom; coalesced LB rebuilds on EDS batch updates are now on by default.
• Container-aware CPU detection is actually on by default — the 1.37 behaviour was only active with --cpuset-threads; it now applies whenever --concurrency is unset.
• Drain is event-driven: drain-close decisions are pushed to connections when the drain starts rather than polled per response, which also fixes inbound-only drain for the Mongo/Redis/Thrift/generic proxies.
• Hot restart for UDP: established UDP proxy sessions are kept by the parent while unknown-session datagrams are forwarded to the child, so connectionless listeners no longer go dark during drain.

AI / MCP

• The AI Protocol Manager filter (alpha) gains response-side LLM token-usage extraction for OpenAI, Anthropic and Gemini dialects (SSE and JSON), published as typed dynamic metadata (envoy.data.ai.v3.TokenUsage), plus request-info, schema-validation and transcoding sub-filters and body re-serialization.
• MCP filter: per-route config, protocol-version enforcement, required client capabilities, new method groups, no-op mode and early termination when routable. The JSON/REST bridge adds server discovery, header/protocol-version validation and result types, and now prevents path traversal via template variables.

Dynamic modules

• New extension points: cluster specifier, route specifier, header formatter, early header mutation, TLS handshaker, transport-socket relay, config validator, and downstream STARTTLS.
• Dynamic-module clusters can now delegate host selection to Envoy's built-in LBs (ROUND_ROBIN, LEAST_REQUEST, RANDOM, RING_HASH, MAGLEV).
• Broad hardening: a large batch of lifetime/view fixes across HTTP, network, listener and cluster-LB filter state, deferred HTTP filter destroy, panic/exception barriers in the Go and C++ SDKs, re-entrancy fixes for callouts, and RTLD_NOW loading with logged load failures.
• Typed metadata get/set, runtime getters, tracing spans across hooks, stream timing, upstream attempt/peer-address accessors, and Go SDK stats/log-level getters.

Security and auth

• Carries forward the 1.39.x security fixes: URL normalization of path parameters (CVE-2026-73511/73551), HTTP/2 trailers-without-END_STREAM and dropped-Host accounting (CVE-2026-73513/73550), HTTP/3 UAF (CVE-2026-73512), ext_authz pathless-request crash and UAF (CVE-2026-73547/50572), generic-upgrade body pipelining (CVE-2026-73548), safe_regex Latin1 mode (CVE-2026-73552), RBAC ignore_path_parameters (CVE-2026-73553), admin stat-name sanitization (CVE-2026-73546), and the oauth2/api_key_auth CONNECT crashes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j), Out-of-Bounds Write in Brotli Decompressor (GHSA-3wvj-j6qm-62mr).
• TLS: per-certificate TLS params, multiple upstream certificates with a certificate selector, SPIFFE upstream SAN validation, SDS file polling, and upstream session cache scoped by SNI.
• OAuth2 gains assertion audience/key-id and TLS client auth for the credential injector; JWT auth gains claim paths and a JWT-claim rate-limit descriptor; GCP auth gains scopes, audiences and IAM access tokens; ext_authz gains shadow mode on the network filter and route-cache-clearing headers.

Observability

• Access logs: downstream handshake time points and connection RTT, listener name and route-resolution-time formatters, CEL-expression formatter config, and nanosecond histogram units.
• OpenTelemetry: resource detectors, custom exporters, instrumentation scope, and typed custom tags; ext_authz and ext_proc emit client spans.
• Stats: per-cluster/listener stats matchers, explicit tags, and a fix for Prometheus native-histogram bucket indices being off by one.

Other notable changes

• HTTP/1 now accepts the RFC 10008 QUERY method (revertible); QUERY without Content-Type is rejected on all protocols.
• Redis proxy: RESP3 protocol support, CLUSTER SHARDS, stricter RESP decoding, and several use-after-free fixes.
• Reverse tunnels: JWT handshake auth, maintain interval, fail-closed identifier validation, and a batch of handshake lifecycle fixes.
• Watchdog backtrace action, UDP health checker, multi-health-checker, TCP proxy load-shed points, and a body-size-limit HTTP filter.
• Fixed a family of races where route-level configuration (AWS signing, composite, filter chain, local ratelimit, dynamic modules, SDS secrets) could be destroyed on a worker thread after an RDS update.

Deprecations

• envoy.extensions.config.validators factories keyed by type URL; dynamic-module log and timing-info callbacks; legacy HTTP filter factory base classes; reverse-tunnel auto_close_connections; Wasm plugin-level capability restriction.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.40.0
Docs:
https://www.envoyproxy.io/docs/envoy/v1.40.0/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.40.0/version_history/v1.40/v1.40.0
Full changelog:
v1.39.0...v1.40.0

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io

Summary of changes:

• Bug fixes:

• aws: fixed a race where the route-level configuration of the AWS
  request signing and AWS Lambda filters could be destroyed on a worker
  thread when an RDS update replaced the route configuration.
• composite: fixed a race where the route-level configuration of the
  composite filter could be destroyed on a worker thread when an RDS
  update replaced the route configuration.
• dynamic_modules: fixed a bug where the per-route config destroy hook
  could run on a worker thread, and the module could be unloaded there,
  when an RDS update replaced the route configuration.
• filter_chain: fixed a race where the route-level configuration of the
  filter chain filter could be destroyed on a worker thread when an RDS
  update replaced the route configuration.
• local_ratelimit: fixed a race where the share provider manager owned
  by a local rate limit route-level configuration could be destroyed on a
  worker thread.
• sds: fixed a race where a generic secret provider shared with worker
  threads could be destroyed on a worker thread.
• stats: fixed a bug introduced in 1.38.0 that exported Prometheus
  native histogram bucket indices one bucket too low, causing consumers to
  decode observations into lower value ranges and underreport quantiles.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.39.4
Docs:
https://www.envoyproxy.io/docs/envoy/v1.39.4/
Release notes:

https://www.envoyproxy.io/docs/envoy/v1.39.4/version_history/v1.39/v1.39.4
Full changelog:
v1.39.3...v1.39.4

Signed-off-by: Jonh Wendell jwendell@redhat.com
Signed-off-by: Ryan Northey ryan@synca.io