https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:23:46 +0000 https://cve.radiocsirt.org/vuln/bit-cilium-2023-30851 <p><strong>Affected:</strong> Bitnami: cilium</p> <p>Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> <p><strong>Affected:</strong> Bitnami: cilium</p> <p>Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> https://cve.radiocsirt.org/vuln/bit-cilium-2023-30851 https://cve.radiocsirt.org/vuln/euvd-2026-210777 EUVD-2026-210777 https://cve.radiocsirt.org/vuln/euvd-2026-210777 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30851 <p>Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> <p>Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30851 https://cve.radiocsirt.org/vuln/ghsa-2h44-x2wx-49f4 <p><strong>Affected:</strong> Go: github.com/cilium/cilium</p> <p>### Impact</p> <p>This issue only impacts users who:</p> <p>- Have a HTTP policy that applies to multiple `toEndpoints` AND - Have an allow-all rule in place that affects only one of those endpoints</p> <p>In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.</p> <p>### Patches</p> <p>This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> <p>### Workarounds</p> <p>Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:</p> <p>``` egress: - toEndpoints: - matchLabels: k8s:kind: echo - matchLabels: k8s:kind: example toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; ```</p> <p>It should be rewritten to: ``` egress: - toEndpoints: - matchLabels: k8s:kind: echo toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; - toEndpoints: - matchLabels: k8s:kind: example toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; ```</p> <p>### Acknowledgements</p> <p>The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.</p> <p>### For more inform…</p> <p><strong>Affected:</strong> Go: github.com/cilium/cilium</p> <p>### Impact</p> <p>This issue only impacts users who:</p> <p>- Have a HTTP policy that applies to multiple `toEndpoints` AND - Have an allow-all rule in place that affects only one of those endpoints</p> <p>In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.</p> <p>### Patches</p> <p>This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.</p> <p>### Workarounds</p> <p>Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:</p> <p>``` egress: - toEndpoints: - matchLabels: k8s:kind: echo - matchLabels: k8s:kind: example toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; ```</p> <p>It should be rewritten to: ``` egress: - toEndpoints: - matchLabels: k8s:kind: echo toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; - toEndpoints: - matchLabels: k8s:kind: example toPorts: - ports: - port: &#34;8080&#34; protocol: TCP rules: http: - method: &#34;GET&#34; ```</p> <p>### Acknowledgements</p> <p>The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.</p> <p>### For more inform…</p> https://cve.radiocsirt.org/vuln/ghsa-2h44-x2wx-49f4 https://cve.radiocsirt.org/vuln/gsd-2023-30851 gsd-2023-30851 https://cve.radiocsirt.org/vuln/gsd-2023-30851