Affected by GO-2025-3560
and 3 other vulnerabilities
GO-2025-3560: Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers in github.com/cilium/cilium
GO-2025-3561: Cilium node based network policies may incorrectly allow workload traffic in github.com/cilium/cilium
GO-2025-3635: In Cilium, packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters in github.com/cilium/cilium
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
MustCompile wraps go-version.NewConstraint, panicing when an error is
returns (this occurs when the constraint cannot be parsed).
It is intended to be use similar to re.MustCompile, to ensure unparseable
constraints are caught in testing.