diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 88f1a5a2..bafe482f 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -2,8 +2,8 @@ REPOSITORY_LOCATIONS = dict(
     # can't have more than one comment between envoy line and commit line in 
     # order to accommodate `check_extensions_build_config.sh`
     envoy = dict(
-        # envoy v1.32.1
-        commit = "f7f0a80edac7e3fd6e37330b7307416c67f954ab",
+        # envoy v1.32.3
+        commit = "58bd599ebd5918d4d005de60954fcd2cb00abd95",
         remote = "https://github.com/envoyproxy/envoy",
     ),
     inja = dict(
diff --git a/changelog/v1.32.3-patch1/bumpenvoy.yaml b/changelog/v1.32.3-patch1/bumpenvoy.yaml
new file mode 100644
index 00000000..8d4ec70a
--- /dev/null
+++ b/changelog/v1.32.3-patch1/bumpenvoy.yaml
@@ -0,0 +1,11 @@
+changelog:
+  - type: DEPENDENCY_BUMP
+    issueLink: https://github.com/solo-io/envoy-gloo-ee/issues/868
+    dependencyOwner: envoyproxy
+    dependencyRepo: envoy
+    dependencyTag: 1.32.3
+    resolvesIssue: false
+    description: >-
+      CVE-2024-53269: Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.
+      CVE-2024-53270: HTTP/1: sending overload crashes when the request is reset beforehand
+      CVE-2024-53271: HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset
\ No newline at end of file