CVE-2025-32793

MEDIUM

Cilium 1.15.0-1.15.15, 1.16.0-1.16.8, 1.17.0-1.17.2 - Cleartext Transmission via WireGuard Race Condition

Title source: llm
STIX 2.1

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4

Scores

CVSS v3 4.0
EPSS 0.0012
EPSS Percentile 2.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-319 CWE-362
Status published
Products (2)
cilium/cilium 1.13.0 - 1.15.16
cilium/cilium 1.13.0 - 1.15.16Go
Published Apr 21, 2025
Tracked Since Feb 18, 2026