●Change8

v1.37.6

Breaking Changes
📦 envoyView on GitHub →
⚠ 4 breaking🐛 4 fixes🔧 8 symbols

Summary

This release addresses multiple security vulnerabilities including issues with URL normalization, HTTP/3, HTTP/2, ext_authz, and QUIC. It also includes several bug fixes for the http filter manager, ext_proc filter, and router.

⚠️ Breaking Changes

  • URL normalization now strips path parameters from individual path segments per RFC 3986 section 3.3. This may affect routing if path parameters were previously relied upon. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
  • URL normalization now strips path parameters from dot and dotdot segments (`/.;`, `/..;`) when `normalize_path` is enabled, ensuring correct canonicalization. Revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
  • The safe_regex charset mode has been switched from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with envoy.reloadable_features.re2_use_latin1_mode.
  • RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authorization bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.

Migration Steps

  1. Consider reverting the following features if they cause issues: envoy.reloadable_features.strip_path_parameters_per_segment, envoy.reloadable_features.strip_dotdot_segments_with_parameters, envoy.reloadable_features.re2_use_latin1_mode, envoy.reloadable_features.rbac_respect_ignore_path_parameters, envoy.reloadable_features.filter_manager_forward_added_data_on_continue, envoy.reloadable_features.ext_proc_return_stop_iteration.

🐛 Bug Fixes

  • Fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
  • Fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
  • Fixed a bug where unnecessary empty data chunks were processed by the filter chain. Revert with envoy.reloadable_features.ext_proc_return_stop_iteration.
  • Fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending.

Affected Symbols

envoy.reloadable_features.strip_path_parameters_per_segmentenvoy.reloadable_features.http_pause_generic_upgrade_request_bodyenvoy.reloadable_features.http2_track_size_of_dropped_host_headerenvoy.reloadable_features.strip_dotdot_segments_with_parametersenvoy.reloadable_features.re2_use_latin1_modeenvoy.reloadable_features.rbac_respect_ignore_path_parametersenvoy.reloadable_features.filter_manager_forward_added_data_on_continueenvoy.reloadable_features.ext_proc_return_stop_iteration