v1.34.1

Summary of changes:

• Security:

  • CVE-2025-46821: Bypass of RBAC uri_template permission.

• Build:

  • Assorted minor fixes.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.34.1
Docs:
https://www.envoyproxy.io/docs/envoy/v1.34.1/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.34.1/version_history/v1.34/v1.34.1
Full changelog:
v1.34.0...v1.34.1

Signed-off-by: Yan Avlasov [email protected]
Signed-off-by: Boteng Yao [email protected]
Signed-off-by: Ryan Northey [email protected]

v1.33.3

Summary of changes:

• Security:
  • CVE-2025-46821: Bypass of RBAC uri_template permission.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.3
Docs:
https://www.envoyproxy.io/docs/envoy/v1.33.3/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.33.3/version_history/v1.33/v1.33.3
Full changelog:
v1.33.2...v1.33.3

Signed-off-by: Yan Avlasov [email protected]
Signed-off-by: Boteng Yao [email protected]
Signed-off-by: Ryan Northey [email protected]

v1.32.6

repo: Release v1.32.6

Summary of changes:

• Security:
  • CVE-2025-46821: Bypass of RBAC uri_template permission.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.32.6
Docs:
https://www.envoyproxy.io/docs/envoy/v1.32.6/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.32.6/version_history/v1.32/v1.32.6
Full changelog:
v1.32.5...v1.32.6

Signed-off-by: Yan Avlasov [email protected]
Signed-off-by: Boteng Yao [email protected]
Signed-off-by: Ryan Northey [email protected]

v1.31.8

Summary of changes:

• Security:
  • CVE-2025-46821: Bypass of RBAC uri_template permission.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.31.8
Docs:
https://www.envoyproxy.io/docs/envoy/v1.31.8/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.31.8/version_history/v1.31/v1.31.8
Full changelog:
v1.31.7...v1.31.8

Signed-off-by: Yan Avlasov [email protected]
Signed-off-by: Boteng Yao [email protected]
Signed-off-by: Ryan Northey [email protected]

v1.34.0

Summary of changes:

• Security:

  • CVE-2025-30157: Fixed a bug where local replies were incorrectly sent to the ext_proc server.
  • CVE-2025-31498: Updated c-ares to version 1.34.5 to address a security vulnerability.

• HTTP:

  • Added support for async load balancing, allowing endpoints to respond with their ability to handle requests.
  • Improved HTTP/1 parser to handle newlines between requests correctly per RFC 9112.
  • Added option to ignore specific HTTP/1.1 upgrade values using configurable matchers.
  • Implemented TCP proxy option to read from downstream connections before establishing upstream connections.

• Performance:

  • Improved performance for HTTP/1 ignored upgrades.
  • Enhanced TCP proxy retries to run in a different event loop iteration to avoid connection issues.
  • Added fixed value option for minimum RTT in adaptive concurrency filter.
  • Enhanced dynamic forward proxy with async lookups for null hosts.

• Reliability:

  • Fixed a bug in preconnecting logic that could lead to excessive connection establishment.
  • Fixed port exhaustion issues in the original_src filter by setting the IP_BIND_ADDRESS_NO_PORT socket option.
  • Fixed socket option application for additional listener addresses.
  • Fixed crash when creating an EDS cluster with invalid configuration.

• Features:

  • Added support for loading shared libraries at runtime through dynamic modules.
  • Added support for io_uring in the default socket interface.
  • Extended the compression filter with the ability to skip compression for specific response codes.
  • Added support for QUIC-LB draft standard for connection ID generation.
  • Enhanced ext_proc with graceful gRPC side stream closing and added a new FULL_DUPLEX_STREAMED body mode.
  • Introduced PKCE support for OAuth2 authorization code flow and SameSite cookie attribute configuration.
  • Added support for monitoring container CPU utilization in Linux Kubernetes environments.
  • Enhanced proxy protocol TLV support to enable more flexible and customizable usage between downstream and upstream connections.
  • Added multiple formatter attributes improvements, e.g., QUERY_PARAM, CUSTOM_FLAGS, and PATH

• Observability:

  • Enhanced Transport Tap with connection information output per event.
  • Added support for directing LRS to report loads when requests are issued.

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.34.0
Docs:
https://www.envoyproxy.io/docs/envoy/v1.34.0/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.34.0/version_history/v1.34/v1.34.0
Full changelog:
v1.33.0...v1.34.0

Signed-off-by: Greg Greenway [email protected]
Signed-off-by: Boteng Yao [email protected]
Signed-off-by: Ryan Northey [email protected]

v1.33.2

Summary of changes:

Container update

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.2
Docs:
https://www.envoyproxy.io/docs/envoy/v1.33.2/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.33.2/version_history/v1.33/v1.33.2
Full changelog:
v1.33.1...v1.33.2

Signed-off-by: Ryan Northey [email protected]

v1.32.5

Summary of changes:

Container update

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.32.5
Docs:
https://www.envoyproxy.io/docs/envoy/v1.32.5/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.32.5/version_history/v1.32/v1.32.5
Full changelog:
v1.32.4...v1.32.5

Signed-off-by: Ryan Northey [email protected]

v1.31.7

Summary of changes:

Container update/fix

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.31.7
Docs:
https://www.envoyproxy.io/docs/envoy/v1.31.7/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.31.7/version_history/v1.31/v1.31.7
Full changelog:
v1.31.6...v1.31.7

Signed-off-by: Ryan Northey [email protected]

v1.30.11

Summary of changes:

Container update/fix

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.30.11
Docs:
https://www.envoyproxy.io/docs/envoy/v1.30.11/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.30.11/version_history/v1.30/v1.30.11
Full changelog:
v1.30.10...v1.30.11

Signed-off-by: Ryan Northey [email protected]

v1.33.1

CVE-2025-30157: Fix a bug where local replies were incorrectly sent to the ext_proc server

Docker images:
https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.33.1
Docs:
https://www.envoyproxy.io/docs/envoy/v1.33.1/
Release notes:
https://www.envoyproxy.io/docs/envoy/v1.33.1/version_history/v1.33/v1.33.1
Full changelog:
v1.33.0...v1.33.1

Signed-off-by: Ryan Northey [email protected]
Signed-off-by: Boteng Yao [email protected]