CVE-2025-64715

MEDIUM EPSS 5.6%
Published Nov 29, 20257mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Nov 29, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys which use egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended. This issue has been patched in versions 1.16.17, 1.17.10, and 1.18.4. There are no workarounds for this issue.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
5.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-284

Affected Products 3

VendorProductVersionRange
ciliumcilium* <1.16.17
ciliumcilium*≥1.17.0  –  <1.17.10
ciliumcilium*≥1.18.0  –  <1.18.4

References 5

  • github.com https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97
    Patch
  • github.com https://github.com/cilium/cilium/releases/tag/v1.16.17
    Release Notes
  • github.com https://github.com/cilium/cilium/releases/tag/v1.17.10
    Release Notes
  • github.com https://github.com/cilium/cilium/releases/tag/v1.18.4
    Release Notes
  • github.com https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm
    PatchVendor Advisory

Remediation

  • github.com https://github.com/cilium/cilium/commit/a385856b59c8289cc7273fa3a3062bbf0ef96c97
    Patch
  • github.com https://github.com/cilium/cilium/security/advisories/GHSA-38pp-6gcp-rqvm
    PatchVendor Advisory