●Change8

v1.39.1

Breaking Changes
📦 envoyView on GitHub →
⚠ 5 breaking🐛 4 fixes🔧 10 symbols

Summary

This release addresses multiple security vulnerabilities across various components including URL normalization, HTTP/3, HTTP/2, ext_authz, and QUIC. It also includes bug fixes for the filter manager, ext_proc, and TLS handling.

⚠️ Breaking Changes

  • Url normalization now strips path parameters from individual path segments per RFC 3986 section 3.3. This may affect routing if path parameters were previously relied upon. Revert with envoy.reloadable_features.strip_path_parameters_per_segment.
  • Http2: Dropped `Host` headers now count towards request header map size and count limits. This may cause previously accepted requests to be rejected if they exceed these limits due to dropped Host headers. Revert with envoy.reloadable_features.http2_track_size_of_dropped_host_header.
  • Url normalization: When `normalize_path` is enabled, path parameters are now stripped from dot and dotdot segments (e.g., `/.;`, `/..;`) to ensure correct canonicalization. This change affects how paths with parameters in segments like `.` or `..` are processed. Revert with envoy.reloadable_features.strip_dotdot_segments_with_parameters.
  • Safe_regex: The charset mode has been switched from UTF-8 to Latin1, as HTTP headers are not UTF-8 encoded. This change might affect regex matching if the previous UTF-8 interpretation was relied upon. Revert with envoy.reloadable_features.re2_use_latin1_mode.
  • Rbac: RBAC path matching now respects the route's `ignore_path_parameters_in_path_matching` setting. This prevents authorization bypass via appended path parameters. Revert with envoy.reloadable_features.rbac_respect_ignore_path_parameters.

🐛 Bug Fixes

  • Fixed a filter manager bug where a body frame moved into the filter-manager buffer via addDecodedData()/addEncodedData() immediately before returning Continue was silently dropped, corrupting large streamed bodies. Revert with envoy.reloadable_features.filter_manager_forward_added_data_on_continue.
  • Fixed multiple lifetime bugs in the ext_proc filter and the underlying gRPC async client that could lead to use-after-free or double delivery of callbacks.
  • Fixed a memory leak in the OpenSSL compatibility layer where SSL_get0_peer_certificates() leaked an X509 refcount per call, preventing certificates from being freed on connection close.
  • Fixed a bug where OpenSSL used glibc's allocator instead of tcmalloc, operating on a separate heap and making OpenSSL allocations invisible to tcmalloc heap profiling.

Affected Symbols

envoy.reloadable_features.strip_path_parameters_per_segmentenvoy.reloadable_features.http2_track_size_of_dropped_host_headerenvoy.reloadable_features.strip_dotdot_segments_with_parametersenvoy.reloadable_features.re2_use_latin1_modeenvoy.reloadable_features.rbac_respect_ignore_path_parametersenvoy.reloadable_features.filter_manager_forward_added_data_on_continueext_proc filtergRPC async clientOpenSSL compatibility layerSSL_get0_peer_certificates()