Affected by GO-2024-3071
and 12 other vulnerabilities
GO-2024-3071: Gateway API route matching order contradicts specification in github.com/cilium/cilium
GO-2024-3074: Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API in github.com/cilium/cilium
GO-2024-3290: Cilium's Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in github.com/cilium/cilium
GO-2025-3415: DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
GO-2025-3416: Cilium has an information leakage via insecure default Hubble UI CORS header in github.com/cilium/cilium
GO-2025-3560: Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium
GO-2025-3561: Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium
GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
New creates a network namespace and returns a handle to it.
The namespace created by this call is not pinned and will be closed when the
last process in the namespace terminates, or when the handle is either
Close()d explicitly or garbage collected.
OpenPinned opens a handle to the existing, pinned network namespace at the
given path. Useful for running code within a netns managed by another process
that pinned a network namespace to an nsfs.
Close closes the handle to the network namespace. This does not necessarily
mean destroying the network namespace itself, which only happens when all
references to it are gone and all of its processes have been terminated.
Do runs the provided func in the netns without changing the calling thread's
netns.
The code in f and any code called by f must NOT call runtime.LockOSThread,
as this could leave the goroutine created by Do permanently pinned to an OS
thread.
Affected by 
Documentation
¶
Source Files