From 35e2477c77452fcb98621cde8c330e417f3b7792 Mon Sep 17 00:00:00 2001 From: Ivan Shumkov Date: Thu, 4 Jun 2026 11:12:56 +0700 Subject: [PATCH] fix: bump Envoy to v1.35.11 to patch HTTP/2 DoS (CVE-2026-47774) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Envoy v1.30.1 is affected by GHSA-22m2-hvr2-xqc8 (CVE-2026-47774, CVSS 7.5): an unauthenticated HTTP/2 downstream memory-exhaustion DoS where cookie header bytes bypass `max_request_headers_kb` and HPACK decode amplification expands small encoded headers into large decoded ones. The 1.30 line is EOL with no backport. Of the advisory's listed fix versions (1.35.11 / 1.36.7 / 1.37.3 / 1.38.1), only v1.35.11 is published upstream so far, so we move to that line — also the smallest jump, lowest config-deprecation risk. The hot-restart wrapper, scripts, and entrypoint are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 2492d23..a145f71 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM envoyproxy/envoy:v1.30.1 +FROM envoyproxy/envoy:v1.35.11 RUN apt update && \ apt -qq -y install python3 && \