CVSS 3.1
4.0 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NCVE-2025-32793
Medium (4.0) in cilium cilium. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in github.com/cilium/cilium 1.15.16, 1.16.9, 1.17.3.
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-362, CWE-319
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cilium:cilium
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5vxx-c285-pcq4 | Go | github.com/cilium/cilium | >=1.13.0 <1.15.16 | 1.15.16 |
| GHSA-5vxx-c285-pcq4 | Go | github.com/cilium/cilium | >=1.16.0 <1.16.9 | 1.16.9 |
| GHSA-5vxx-c285-pcq4 | Go | github.com/cilium/cilium | >=1.17.0 <1.17.3 | 1.17.3 |
| GO-2025-3635 | Go | github.com/cilium/cilium | >=1.13.0 <1.15.16 >=1.16.0 <1.16.9 >=1.17.0 <1.17.3 | 1.15.16, 1.16.9, 1.17.3 |