CVE-2024-42487: Cilium's Gateway API route matching order contradicts specification
Vulnerability summary
CVE-2024-42487 is a medium (CVSS 4.3) HTTP Request/Response Splitting vulnerability in cilium. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 11Timeline
- 15-08-2024PublishedVulnerability first disclosed.
- 15-08-2024Last modifiedVulnerability information updated.
Description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NDiffers
- OSV · GoEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.53% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Affected systems
Chainguard35 products
- cilium-1.15< 1.15.19-r3 | < 1.15.8-r0
- cilium-1.15-clustermesh-apiserver< 1.15.8-r0
- cilium-1.15-container-init< 1.15.8-r0
- cilium-1.15-container-init-compat< 1.15.8-r0
- cilium-1.15-hubble-relay< 1.15.8-r0
Wolfi5 products
- cilium-cli< 0.16.15-r2
- hubble< 1.16.0-r1
- hubble-compat< 1.16.0-r1
- hubble-ui< 0.13.1-r5
- hubble-ui-backend< 0.13.1-r5
Cilium1 product
- ciliumEOL= 1.16.0 | ≥ 1.15.0, < 1.15.8 | 1.16.0
Github.com/cilium1 product
- cilium≥ 1.15.0, < 1.15.8 | ≥ 1.16.0, < 1.16.1
4 vendors · 42 products
References
8 links- github.com/cilium/cilium/security/advisories/GHSA-qcm3-7879-xcwwX Refsource CONFIRMAdvisoryWEBVendor Advisory
- github.com/cilium/cilium/commit/a3510fe4a92305822aa1a5e08cb6d6c873c8699aX Refsource MISCFIXWEBPatchThird Party Advisory
- github.com/cilium/ciliumPACKAGE