1.13.2.yaml

date: June 8, 2020

changes:
- area: http
  change: |
    added :ref:`headers_with_underscores_action setting <envoy_api_field_core.HttpProtocolOptions.headers_with_underscores_action>` to control how client requests with header names containing underscore characters are handled. The options are to allow such headers, reject request or drop headers. The default is to allow headers, preserving existing behavior.
- area: http
  change: |
    fixed CVE-2020-11080 by rejecting HTTP/2 SETTINGS frames with too many parameters.