Issues

• vhds: initial wildcard subscription sends identical unscoped requests across route configs

  triage
  envoyproxy/envoy#49189 · Filter by author antoniovleonti opened on Nov 11, 2026

• on_demand: discover request mirror (shadow) clusters with on-demand CDS

  envoyproxy/envoy#49175 · Filter by author xuanmin-zhu opened on Nov 11, 2026

• Isolate per-attempt FilterState for upstream HTTP filters

  envoyproxy/envoy#49156 · Filter by author paul-r-gall opened on Nov 10, 2026
  

• internal listener: buffered reads dropped on peer close, no CLOSE_WAIT

  envoyproxy/envoy#49119 · Filter by author PetrMc opened on Nov 9, 2026
  1

• tcp_proxy: CONNECT origination drops buffered data on downstream close

  envoyproxy/envoy#49118 · Filter by author PetrMc opened on Nov 9, 2026
  1

• tls: certificate expiration gauge remains after removing regular SDS listener certificates

  bug
  envoyproxy/envoy#49087 · Filter by author noonvoyager opened on Nov 8, 2026

• [OAUTH2 / OIDC] OIDC logout includes an empty id_token_hint, causing Keycloak to reject the request

  bug
  envoyproxy/envoy#49049 · Filter by author Orliva opened on Nov 6, 2026
  1

• ext_authz: gRPC CheckResponse with error_response but no status is treated as OK, contrary to the error_response docs

  area/ext_authz
  envoyproxy/envoy#49041 · Filter by author omkhar opened on Nov 5, 2026

• upstream: filter state transport socket matching can share a connection pool across different matches

  bug
  envoyproxy/envoy#49040 · Filter by author omkhar opened on Nov 5, 2026

• conn_pool: use-after-free when attaching a 0-RTT early data stream cancels another pending stream

  bug
  envoyproxy/envoy#49038 · Filter by author omkhar opened on Nov 5, 2026

• http_11_proxy: support DNS hostnames for the proxy address (metadata and default_proxy_address)

  area/httpenhancement
  envoyproxy/envoy#49027 · Filter by author MatyMatousek opened on Nov 5, 2026
  1

• oauth2: support OAuth 2.0 DPoP (RFC 9449) for token acquisition

  area/oauthenhancement
  envoyproxy/envoy#49018 · Filter by author denniskniep opened on Nov 4, 2026
  1

• jwt_authn: Support OAuth 2.0 DPoP Validation (RFC 9449)

  area/oauthenhancement
  envoyproxy/envoy#48994 · Filter by author denniskniep opened on Nov 4, 2026
  1

• Graceful EDS host removal while replacement endpoints warm up under active health checking

  area/edsenhancement
  envoyproxy/envoy#48961 · Filter by author raffomartini opened on Nov 3, 2026
  2

  

• basic_auth: forward_username_header is not cleared on the allow_missing bypass paths, so a client-supplied value reaches the backend

  envoyproxy/envoy#48957 · Filter by author thesecguy45 opened on Nov 3, 2026

• basic_auth: client-supplied forward_username_header is passed through unchanged on allow_missing bypass paths

  envoyproxy/envoy#48949 · Filter by author thesecguy45 opened on Nov 3, 2026
  1

• Clarify CEL version selection in the API module

  area/build
  envoyproxy/envoy#48921 · Filter by author rulex123 opened on Nov 2, 2026
  3

• quic: mTLS resumption default not applied when the validation context comes from SDS

  envoyproxy/envoy#48914 · Filter by author bneigher opened on Nov 2, 2026

• ext_proc: header mutations silently ignore HeaderValueOption.append_action (follow-up to #36982)

  bugext-proc
  envoyproxy/envoy#48886 · Filter by author LoGan070raGnaR opened on Oct 31, 2026
  1

• dynamic_modules: add streaming HTTP callouts to bootstrap extensions

  envoyproxy/envoy#48877 · Filter by author yskopets opened on Oct 30, 2026
  1

• udp: downstream_rx_datagram_dropped jumps by ~2^32 when truncated (oversize) datagrams are followed by the socket's first kernel drop

  envoyproxy/envoy#48873 · Filter by author TimDiam0nd opened on Oct 30, 2026
  2

• SDS: a TLS certificate that fails to load is still recorded as the current secret, so re-sending it is ACKed without loading and config_dump reports it as active

  area/sdsbug
  envoyproxy/envoy#48860 · Filter by author patoda opened on Oct 30, 2026
  2

• OpenSSL Shim: Route OpenSSL's allocations to Envoy's tcmalloc

  area/perfarea/ssl
  envoyproxy/envoy#48859 · Filter by author Sukhdev841 opened on Oct 30, 2026
  3

• dynamic_modules: the Go SDK has no bindings for bootstrap extensions

  envoyproxy/envoy#48854 · Filter by author yskopets opened on Oct 30, 2026

• wasm: let the set_envoy_filter_state foreign function share the object with upstream connections

  envoyproxy/envoy#48832 · Filter by author marcjanek opened on Oct 29, 2026