v1.36.10
Breaking Changes📦 envoyView on GitHub →
⚠ 5 breaking🐛 4 fixes🔧 11 symbols
Summary
This release addresses multiple security vulnerabilities across various components including URL normalization, HTTP/3, HTTP/2, admin, ext_authz, and QUIC. It also includes several bug fixes for filter management, ext_proc, and router functionalities.
⚠️ Breaking Changes
- url normalization: strip path parameters from individual path segments per RFC 3986 section 3.3. Revert with `envoy.reloadable_features.strip_path_parameters_per_segment`.
- http2: dropped `Host` headers now count towards request header map size and count limits. Revert with `envoy.reloadable_features.http2_track_size_of_dropped_host_header`.
- url normalization: strip path parameters from dot and dotdot segments (`/.;`, `/..;`) so canonicalization interprets them correctly. Applies only when `normalize_path` is enabled; revert with `envoy.reloadable_features.strip_dotdot_segments_with_parameters`.
- safe_regex: switch charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with `envoy.reloadable_features.re2_use_latin1_mode`.
- rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authz bypass via appended path parameters. Revert with `envoy.reloadable_features.rbac_respect_ignore_path_parameters`.
🐛 Bug Fixes
- http: fixed a filter manager bug where a body frame moved into the filter-manager buffer via `addDecodedData()`/`addEncodedData()` immediately before returning `Continue` was silently dropped, corrupting large streamed bodies. Revert with `envoy.reloadable_features.filter_manager_forward_added_data_on_continue`.
- ext_proc: fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
- ext_proc: fixed a bug to support two ext_proc filters configured in the chain. Revert with `envoy.reloadable_features.ext_proc_inject_data_with_state_update`.
- router: fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending.