CVE-2025-32793
Fixed in a distro release EPSS <1%CVSS 4.0
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
Products: cilium
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cilium/cilium | 1.15.16 |
| Go | github.com/cilium/cilium | 1.16.9 |
| Go | github.com/cilium/cilium | 1.17.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cilium-1.14-container-init | 1.14.19-r34 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r34 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r34 |
| Chainguard | cilium-fips-1.14-compat | 1.14.19-r56 |
| Chainguard | cilium-fips-1.14-container-init | 1.14.19-r56 |
| Chainguard | cilium-fips-1.14-container-init-compat | 1.14.19-r56 |
| Chainguard | cilium-fips-1.14-iptables | 1.14.19-r56 |
| Chainguard | hubble | 1.17.2-r2 |
| Chainguard | hubble-compat | 1.17.2-r2 |
| Chainguard | hubble-fips | 1.17.2-r2 |
| Chainguard | hubble-fips-compat | 1.17.2-r2 |
| Chainguard | hubble-ui-backend-fips | 0.13.2-r6 |
| Wolfi | cilium-1.14-container-init | 1.14.19-r34 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.19-r34 |
| Wolfi | cilium-1.14-iptables | 1.14.19-r34 |
| Wolfi | hubble | 1.17.2-r2 |
| Wolfi | hubble-compat | 1.17.2-r2 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250422T181640-1.1 |