●Change8

v1.38.4

Breaking Changes
📦 envoyView on GitHub →
⚠ 4 breaking🐛 5 fixes🔧 7 symbols

Summary

This release addresses multiple security vulnerabilities including issues with URL normalization, HTTP/3, HTTP/2, ext_authz, and QUIC. It also includes several bug fixes for filter management, ext_proc, dynamic forward proxy, and TLS memory leaks.

⚠️ Breaking Changes

  • Url normalization now strips path parameters from individual path segments per RFC 3986 section 3.3. This may affect requests with path parameters. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
  • Url normalization now strips path parameters from dot and dotdot segments (`/.;`, `/..;`) when `normalize_path` is enabled, ensuring correct canonicalization. Revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
  • Safe_regex has switched its charset mode from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. Revert with envoy.reloadable_features.re2_use_latin1_mode.
  • RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching`, preventing authorization bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.

🐛 Bug Fixes

  • Fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
  • Fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
  • Fixed a lifetime bug in dynamic forward proxy async host selection when the cluster is removed while lookup is still pending.
  • Fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
  • Fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.

Affected Symbols

envoy.reloadable_features.strip_path_parameters_per_segmentenvoy.reloadable_features.http2_track_size_of_dropped_host_headerenvoy.reloadable_features.strip_dotdot_segments_with_parametersenvoy.reloadable_features.re2_use_latin1_modeenvoy.reloadable_features.rbac_respect_ignore_path_parametersenvoy.reloadable_features.filter_manager_forward_added_data_on_continueenvoy.reloadable_features.http_pause_generic_upgrade_request_body