cloud-native

Envoy v1.39.3 releases security fixes for oauth2 and api_key_auth crashes

Brief written by the FOSSWire AI editor from Envoy Cloud-Native Edge Proxy

October 6, 2026 1 min read Impact: 6/10

Key Takeaway

Envoy v1.39.3 addresses two security vulnerabilities that could cause service crashes during specific CONNECT requests.

Summary

The Envoy proxy team has released version 1.39.3 to address two security vulnerabilities. These issues involve service crashes triggered by requests lacking a :path header, such as CONNECT requests, when using oauth2 or api_key_auth filters.

Security vulnerability details

GHSA-8vc2-jrm4-835w: The oauth2 filter previously crashed on requests without a :path header (e.g., CONNECT). It now rejects these requests with a 400 error.
GHSA-47vj-9r25-wv5j: The api_key_auth filter could crash when hide_credentials was enabled with a query key source if a request without a :path header was authenticated via a different key source.

Original reference: github.com →