CVE-2025-32793: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

April 21, 2025 (updated April 23, 2025)

When using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium.

References

github.com/advisories/GHSA-5vxx-c285-pcq4
github.com/cilium/cilium
github.com/cilium/cilium/commit/e8543eef05126e9ba8a845dc74e96f4e30f6dba9
github.com/cilium/cilium/pull/38592
github.com/cilium/cilium/security/advisories/GHSA-5vxx-c285-pcq4
nvd.nist.gov/vuln/detail/CVE-2025-32793

Code Behaviors & Features

Detect and mitigate CVE-2025-32793 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →