# Envoy 1.37.8 fixes two crash vulnerabilities in authentication filters

> **Key takeaway:** Envoy 1.37.8 patches two denial-of-service vulnerabilities where CONNECT requests lacking a :path header could crash the oauth2 and api_key_auth filters.

**Published:** 2026-10-06T18:53:17+00:00 
**Source:** Envoy Cloud-Native Edge Proxy 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/envoy-1378-fixes-two-crash-vulnerabilities-in-authentication.html 

## Summary
The Envoy proxy project released version 1.37.8 with security fixes for two crash vulnerabilities. Both flaws involve requests without a :path header, which occurs with CONNECT requests. The oauth2 filter would crash outright, while the api_key_auth filter crashed when hide_credentials was enabled with a query key source and authentication came from another key source. Both filters now reject such requests with HTTP 400.

## What the two CVEs fix
- **GHSA-8vc2-jrm4-835w**: oauth2 filter crashed on CONNECT requests missing `:path`; now returns 400 Bad Request
- **GHSA-47vj-9r25-wv5j**: api_key_auth filter crashed when `hide_credentials` + query key source combined with `:path`-less CONNECT request authenticated via alternate key source; now returns 400
- Both are denial-of-service vectors, not authentication bypasses
- Affects deployments using these filters with HTTP CONNECT or similar `:path`-less methods

## Why it matters
Envoy is a widely deployed edge and service mesh proxy in Kubernetes and cloud-native infrastructure. These crashes could be triggered remotely by any client sending a malformed CONNECT request, making the fixes relevant for production operators running affected filter configurations.