GHSA-5vxx-c285-pcq4: Race Condition
First published: Mon Apr 21 2025(Updated: )
### Impact When using [Wireguard transparent encryption](https://docs.cilium.io/en/stable/security/network/encryption-wireguard/#encryption-wg) in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. ### Patches This issue has been patched in https://github.com/cilium/cilium/pull/38592. This issue affects: - Cilium v1.15 between v1.15.0 and v1.15.15 inclusive - Cilium v1.16 between v1.16.0 and v1.16.8 inclusive - Cilium v1.17 between v1.17.0 and v1.17.2 inclusive This issue is fixed in: - Cilium v1.15.16 - Cilium v1.16.9 - Cilium v1.17.3 ### Workarounds There is no workaround to this issue. ### Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @gandro and @pippolo84 for reporting this issue and to @julianwiedmann for the patch. ### For more information If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/cilium/cilium | >=1.17.0<1.17.3 | 1.17.3 |
| go/github.com/cilium/cilium | >=1.16.0<1.16.9 | 1.16.9 |
| go/github.com/cilium/cilium | >=1.13.0<1.15.16 | 1.15.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4
- https://github.com/cilium/cilium/pull/38592
- https://github.com/cilium/cilium/commit/e8543eef05126e9ba8a845dc74e96f4e30f6dba9
- https://nvd.nist.gov/vuln/detail/CVE-2025-32793
- https://github.com/advisories/GHSA-5vxx-c285-pcq4 (Advisory)
Frequently Asked Questions
What is the severity of GHSA-5vxx-c285-pcq4?
The severity of GHSA-5vxx-c285-pcq4 is classified as high due to potential unencrypted packet transmission.
How do I fix GHSA-5vxx-c285-pcq4?
To fix GHSA-5vxx-c285-pcq4, upgrade to Cilium version 1.17.3, 1.16.9, or 1.15.16 depending on your current version.
Which software versions are affected by GHSA-5vxx-c285-pcq4?
GHSA-5vxx-c285-pcq4 affects Cilium versions 1.17.0 to 1.17.3, 1.16.0 to 1.16.9, and 1.13.0 to 1.15.16.
What is the impact of GHSA-5vxx-c285-pcq4 in Cilium clusters?
The impact of GHSA-5vxx-c285-pcq4 in Cilium clusters is that packets may leave the source node unencrypted due to a race condition.
Is there a workaround for GHSA-5vxx-c285-pcq4?
There is no documented workaround for GHSA-5vxx-c285-pcq4; the recommended action is to update to a secure version.
- agent/severity
- agent/source
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5vxx-c285-pcq4
- alias/CVE-2025-32793
- agent/software-canonical-lookup
- package-manager/go