CVE-2025-32793: Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters
First published: Mon Apr 21 2025(Updated: )
### Impact When using [Wireguard transparent encryption](https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg) in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. ### Patches This issue has been patched in https://github.com/cilium/cilium/pull/38592. This issue affects: - Cilium v1.15 between v1.15.0 and v1.15.15 inclusive - Cilium v1.16 between v1.16.0 and v1.16.8 inclusive - Cilium v1.17 between v1.17.0 and v1.17.2 inclusive This issue is fixed in: - Cilium v1.15.16 - Cilium v1.16.9 - Cilium v1.17.3 ### Workarounds There is no workaround to this issue. ### Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch. ### For more information If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cilium Cilium-cli | >=1.15.0<=1.15.15>=1.16.0<=1.16.8>=1.17.0<=1.17.2 | |
| go/github.com/cilium/cilium | >=1.17.0<1.17.3 | 1.17.3 |
| go/github.com/cilium/cilium | >=1.16.0<1.16.9 | 1.16.9 |
| go/github.com/cilium/cilium | >=1.13.0<1.15.16 | 1.15.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4
- https://github.com/cilium/cilium/pull/38592
- https://github.com/cilium/cilium/commit/e8543eef05126e9ba8a845dc74e96f4e30f6dba9
- https://nvd.nist.gov/vuln/detail/CVE-2025-32793
- https://github.com/advisories/GHSA-5vxx-c285-pcq4 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-32793?
CVE-2025-32793 has been classified with a high severity due to its potential impact on encrypted packet handling in Cilium.
How do I fix CVE-2025-32793?
To fix CVE-2025-32793, upgrade Cilium to version 1.15.16, 1.16.9, or 1.17.3 or later.
What versions of Cilium are affected by CVE-2025-32793?
CVE-2025-32793 affects Cilium versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2.
What impact does CVE-2025-32793 have on Cilium clusters?
CVE-2025-32793 can lead to potential exposure of sensitive information due to improper handling of packets with Wireguard encryption.
Is there a workaround for CVE-2025-32793 if upgrading is not possible?
Currently, there is no official workaround for CVE-2025-32793, and upgrading is strongly recommended.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/description
- agent/softwarecombine
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5vxx-c285-pcq4
- alias/CVE-2025-32793
- agent/references
- agent/last-modified-date
- agent/tags
- collector/nvd-cve
- vendor/cilium
- canonical/cilium cilium-cli
- package-manager/go