CVSS 3.1
4.3 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NCVE-2025-30162
Medium (4.3) in cilium cilium. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/cilium/cilium 1.15.15, 1.16.8, 1.17.2.
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cilium:cilium
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-24qp-4xx8-3jvj | Go | github.com/cilium/cilium | >=1.16.0 <1.16.8 | 1.16.8 |
| GHSA-24qp-4xx8-3jvj | Go | github.com/cilium/cilium | >=1.17.0 <1.17.2 | 1.17.2 |
| GHSA-24qp-4xx8-3jvj | Go | github.com/cilium/cilium | >=1.15.0 <1.15.15 | 1.15.15 |
| GO-2025-3560 | Go | github.com/cilium/cilium | >=1.15.0 <1.15.15 >=1.16.0 <1.16.8 >=1.17.0 <1.17.2 | 1.15.15, 1.16.8, 1.17.2 |