FOSSWire
cloud-native

Envoy v1.37.9 releases security fix for Wasmtime and several race conditions

Brief written by the FOSSWire AI editor from Envoy Cloud-Native Edge Proxy

1 min read Impact: 5/10

Key Takeaway

Envoy v1.37.9 addresses CVE-2026-54786 by updating Wasmtime and fixes multiple thread-safety race conditions.

Summary

The Envoy proxy has released version 1.37.9, which includes a critical upstream security update for Wasmtime to resolve CVE-2026-54786. The release also addresses several race conditions affecting AWS filters, local rate limiting, and Secret Discovery Service (SDS) configurations.

Technical improvements in Envoy v1.37.9

  • Security: Upgraded Wasmtime to version 24.0.10 to mitigate CVE-2026-54786.
  • AWS Integration: Fixed a race condition where AWS request signing and AWS Lambda filter configurations could be destroyed on a worker thread during an RDS update.
  • Local Rate Limiting: Resolved a race condition involving the share provider manager in route-level configurations.
  • SDS: Fixed a race condition where a generic secret provider shared with worker threads could be prematurely destroyed.

Why it matters

Users running Wasm-based extensions or AWS-specific filters should update to ensure stability and security.

Original reference: github.com →