Dated component evidence
Envoy Proxy
A bounded release signal for operators who run Envoy as a sidecar or service-networking proxy. It connects a detected official image to upstream release facts without inferring workload exposure or compatibility from the image tag.
Observed releasev1.39.2
Published upstreamOctober 1, 2026 · 18:48 UTC
Evidence checkedOctober 6, 2026 · 14:00 UTC
What was observed
Three release checks worth making.
- Patch scope: Envoy published v1.39.2 with a BoringSSL update for CVE-2026-35189 and refreshed Ubuntu and distroless base images. The same release removed Debian bullseye package publication.
- TLS behavior on the 1.39 line: the v1.39.0 notes say
enforce_rsa_key_usageis ignored and Envoy now always enforces the certificatekeyUsageextension. The notes also describe minimum and maximum client TLS-version checks in the TLS inspector. - Tracing behavior on the 1.39 line: the v1.39.0 notes say the OpenTelemetry tracer now honors Envoy request-entry sampling decisions, so some configurations may export fewer OTLP spans after an upgrade.
Operational guidance
Before changing the image tag.
- Record the exact current image and minor release in the Sidecar BOM. A v1.39.2 patch update and a move from an older minor line have different review scopes.
- If crossing into v1.39, inspect effective TLS configuration for
enforce_rsa_key_usage, verify certificate key-usage extensions, and test the client TLS versions the proxy actually receives. - If Envoy exports traces through the OpenTelemetry tracer, compare effective sampling behavior and expected trace volume before and after the candidate rollout.
- Validate the candidate configuration and exercise real control-plane, listener, upstream, TLS, and telemetry paths in a representative environment before rollout.
Evidence limit: this record reports upstream release information at the observation time. It does not determine whether a deployment is affected by a vulnerability, compatible with v1.39.2, or secure.
Primary sources