Affected by GO-2023-2078
and 19 other vulnerabilities
GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
GO-2024-2568: Unencrypted ingress/health traffic when using Wireguard transparent encryption in github.com/cilium/cilium
GO-2024-2569: Unencrypted traffic between pods when using Wireguard and an external kvstore in github.com/cilium/cilium
GO-2024-2653: HTTP policy bypass in github.com/cilium/cilium
GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
GO-2024-2657: Unencrypted traffic between nodes with WireGuard in github.com/cilium/cilium
GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium
GO-2024-2922: Cilium leaks sensitive information in cilium-bugtool in github.com/cilium/cilium
GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
GO-2024-3208: Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
GO-2025-3415: DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
GO-2025-3416: Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium
GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium
GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
Package ipcache provides a BPF datapath implementation of the IPCache store.
It depends on details from pkg/ipcache (which handles IPCache events), as
well as (indirectly) details such as the KVstore. It is kept distinct from
pkg/maps/ipcache, which only deals with low-level BPF details of the
underlying map.
type BPFListener struct {
// contains filtered or unexported fields
}
BPFListener implements the ipcache.IPIdentityMappingBPFListener
interface with an IPCache store that is backed by BPF maps.
One listener is shared between callers of OnIPIdentityCacheChange() and the
controller launched from OnIPIdentityCacheGC(). However, The listener is not
updated after initialization so no locking is provided for access.
OnIPIdentityCacheChange is called whenever there is a change of state in the
IPCache (pkg/ipcache).
TODO (FIXME): GH-3161.
'oldIPIDPair' is ignored here, because in the BPF maps an update for the
IP->ID mapping will replace any existing contents; knowledge of the old pair
is not required to upsert the new pair.
Affected by 
Documentation
¶
Source Files