cloud-native

Envoy releases v1.37.8 to fix security crashes

Brief written by the FOSSWire AI editor from Envoy Cloud-Native Edge Proxy

October 6, 2026 1 min read Impact: 5/10

Key Takeaway

Envoy v1.37.8 addresses two security vulnerabilities that could cause crashes during CONNECT requests.

Summary

Envoy has released version 1.37.8 to address two security vulnerabilities related to request handling. The update fixes crashes in the oauth2 and api_key_auth filters when processing requests lacking a :path header, such as CONNECT requests.

Security fixes in Envoy v1.37.8

GHSA-8vc2-jrm4-835w: Fixes an oauth2 filter crash occurring on requests without a :path header (e.g., CONNECT); these requests are now rejected with a 400 error.
GHSA-47vj-9r25-wv5j: Fixes an api_key_auth crash when hide_credentials is enabled with a query key source and a request without a :path header is authenticated via a different key source.

Original reference: github.com →