fix: bump Envoy to v1.39.0 to patch DoS advisories and PRIORITY flood bypass - #4
Merged
Merged
Conversation
… bypass
v1.35.11 predates Envoy's 2026-06-23 security batch of 15 advisories.
v1.39.0 closes all of them plus an HTTP/2 flood-protection bypass that was
never backported to any patch line.
Denial of service / crash / memory exhaustion:
- HTTP/2 PRIORITY and WINDOW_UPDATE flood bypass (no CVE assigned):
limits scaled with the cumulative count of streams ever opened, so an
attacker churning streams inflated the budget without bound and never
tripped the limit. Now scales with active streams and retires on close.
- GHSA-p7c7-7c47-pwch (high): HTTP/3 QPACK blocked-decoding DoS
- CVE-2026-48042 (high): stack overflow in destructor of highly nested JSON
- CVE-2026-48044 (high): zstd RLE zip bomb, decompressor memory explosion
- CVE-2026-47207: crash on multiple ext_proc responses in one gRPC message
- CVE-2026-47221: null pointer deref in router internal redirects
- CVE-2026-47204: grpc_stats segfault on Connect requests to direct_response
- CVE-2026-48090: OAuth2 use-after-free on late async token completion
- CVE-2026-48497: abnormal process termination in DNS UDP filter
- CVE-2026-48706: heap buffer overflow in TcpStatsdSink on large stat names
Also fixed:
- CVE-2026-48743 (high): HTTP/3 to HTTP/1 request smuggling
- CVE-2026-47778: embedded NUL TLS SAN truncation, auth bypass
- CVE-2026-47775: OAuth2 padding oracle, plus opt-in AES-256-GCM cookies
- CVE-2026-47692: PROXY protocol v2 skipped-TLV upstream spillover
- CVE-2026-47261: wasmtime bump, upstream dependency
Why 1.39.0 rather than the minimal 1.35.13 bump: the PRIORITY/WINDOW_UPDATE
flood fix shipped as a behavior change under the runtime guard
envoy.reloadable_features.http2_flood_protection_active_streams, not as an
advisory, and was not backported to 1.35.13, 1.36.9, 1.37.5 or 1.38.3. It is
present and enabled by default only in 1.39.0, verified by inspecting
source/common/http/http2/protocol_constraints.h at each tag. The gateway
terminates HTTP/2 from untrusted clients, so this path is reachable.
Moving to 1.39.0 also resets the 12-month backport window; the 1.35 line
reached the end of it (v1.35.0 shipped 2025-07-23).
CVE-2026-47205 (>=1.36) and CVE-2026-47220 (>=1.37.0) never affected 1.35,
but both are fixed in 1.39.0, so the line move adds no new exposure.
Behavior changes in 1.39.0 to validate against gateway config: HeaderMatcher
now evaluates repeated headers individually rather than comma-joined, the TLS
inspector rejects client TLS versions outside 1.0-1.3, enforce_rsa_key_usage
is always enforced, and OpenTelemetry tracing honors Envoy's sampling
decision. The Bazel 8 change does not apply, as this consumes the prebuilt
image.
Base image only. The python3 install, hot-restarter scripts and ENTRYPOINT
are unchanged. No test added: base-image version bump, and the repo has no
test suite. Verified by building the image, confirming the binary reports
1.39.0 with the flood-protection guard compiled in, and exercising the
SIGHUP hot restart end to end: a new epoch started workers while the old
process drained listeners, which is the zero-downtime path dashmate uses.
Refs: https://github.com/envoyproxy/envoy/releases/tag/v1.39.0
Refs: envoyproxy/envoy#45077
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe Dockerfile now uses Envoy base image ChangesEnvoy image update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: Update the Dockerfile to run the hot-restarter.py → start_envoy.sh
entrypoint as a non-root Envoy user. Create or reuse a non-root user with access
to /etc/envoy, then switch to that user via USER or explicit su/gosu before the
ENTRYPOINT.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ktechmidas
self-requested a review
July 26, 2026 12:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the base image from
envoyproxy/envoy:v1.35.11toenvoyproxy/envoy:v1.39.0.v1.35.11 predates Envoy's 2026-06-23 security batch of 15 advisories. v1.39.0 closes all of them, plus an HTTP/2 flood-protection bypass that was never backported to any patch line.
Denial of service / crash / memory exhaustion
Also fixed
Why 1.39.0 rather than the minimal 1.35.13 bump
v1.35.13 closes every published advisory affecting the 1.35 line, and was the initial target. But the PRIORITY/WINDOW_UPDATE flood fix shipped as a behavior change under the runtime guard
envoy.reloadable_features.http2_flood_protection_active_streams, not as an advisory, so it carries no CVE or GHSA and appears in no advisory feed. It was not backported to 1.35.13, 1.36.9, 1.37.5 or 1.38.3.Verified by inspecting
source/common/http/http2/protocol_constraints.hat each tag:RUNTIME_GUARD= on by defaultThe gateway terminates HTTP/2 from untrusted clients, so this path is reachable. Moving to 1.39.0 also resets the 12-month backport window; the 1.35 line reached the end of it (v1.35.0 shipped 2025-07-23).
CVE-2026-47205 (
>=1.36) and CVE-2026-47220 (>=1.37.0) never affected 1.35, but both are fixed in 1.39.0, so the line move adds no new exposure.Behavior changes to validate against gateway config
HeaderMatchernow evaluates repeated headers individually rather than comma-joined (revertible viaenvoy.reloadable_features.match_headers_individually)enforce_rsa_key_usageis deprecated and always enforcedBazel 8 does not apply — this consumes the prebuilt image.
Verification
Base image only. The python3 install,
scripts/{hot-restarter.py,start_envoy.sh}and ENTRYPOINT are unchanged.linux/amd64+linux/arm64, matching the multi-arch build inrelease.yml1.39.0; flood-protection guard compiled in; python3 and both scripts intactNo test added: base-image version bump with no behavior delta in this repo, and there is no test suite here.
Follow-up
Not part of this PR: release tag
v1.39.0-impr.1publishesdashpay/envoy:1.39.0-impr.1, after which the dashmate pin can be bumped. The behavior changes above should be validated against the real gateway config before that pin lands.🤖 Generated with Claude Code
Summary by CodeRabbit