CVE-2025-32793: cilium
Vulnerability summary
CVE-2025-32793 is a medium (CVSS 4.0) vulnerability in cilium. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 5Timeline
- 21-04-2025PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
- NVDNIST4.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
0.00 pp
From 0.14% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-319Cleartext Transmission of Sensitive InformationThe product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Chainguard5 products
- hubble< 1.17.2-r2
- hubble-compat< 1.17.2-r2
- hubble-fips< 1.17.2-r2
- hubble-fips-compat< 1.17.2-r2
- hubble-ui-backend-fips< 0.13.2-r6
Wolfi2 products
- hubble< 1.17.2-r2
- hubble-compat< 1.17.2-r2
Cilium1 product
- cilium≥ v1.13.0, < v1.15.16 | ≥ v1.16.0, < v1.16.9 | ≥ v1.17.0, < v1.17.3 | ≥ 1.13.0, < 1.15.16 | ≥ 1.16.0, < 1.16.9 | ≥ 1.17.0, < 1.17.3
Github.com/cilium1 product
- cilium≥ 1.13.0, < 1.15.16 | ≥ 1.16.0, < 1.16.9 | ≥ 1.17.0, < 1.17.3
4 vendors · 9 products
References
6 links- github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4X Refsource CONFIRMAdvisoryWEBPatchThird Party Advisory
- github.com/cilium/ciliumPACKAGE