Affected by GO-2022-0393
and 18 other vulnerabilities
GO-2022-0393: Network policy may be bypassed by some ICMP Echo Requests in github.com/cilium/cilium
GO-2022-0457: Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium
GO-2022-0458: Improper Privilege Management in Cilium in github.com/cilium/cilium
GO-2022-0959: Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium
GO-2023-1643: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
GO-2023-1730: Debug mode leaks confidential data in Cilium in github.com/cilium/cilium
GO-2023-1785: Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium
GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium
GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium
GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
GO-2026-6596: Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium
type IDPool struct {
// contains filtered or unexported fields
}
IDPool represents a pool of IDs that can be managed concurrently
via local usage and external events.
An intermediate state (leased) is introduced to the life cycle
of an ID in the pool, in order to prevent lost updates to the
pool that can occur as a result of employing both management schemes
simultaneously.
Local usage of an ID becomes a two stage process of leasing
the ID from the pool, and later, Use()ing or Release()ing the ID on
the pool upon successful or unsuccessful usage respectively,
The table below shows the state transitions in the ID's life cycle.
In the case of LeaseAvailableID() the ID is returned rather
than provided as an input to the operation.
All ID's begin in the available state.
---------------------------------------------------------------------
|state\event | LeaseAvailableID | Release | Use | Insert | Remove |
---------------------------------------------------------------------
|1 available | 2 | * | * | * | 3 |
---------------------------------------------------------------------
|2 leased | ** | 1 | 3 | * | 3 |
---------------------------------------------------------------------
|3 unavailable | ** | * | * | 1 | * |
---------------------------------------------------------------------
* The event has no effect.
** This is guaranteed never to occur.
Release returns a leased ID back to the pool.
This operation accounts for IDs that were previously leased
from the pool but were unused, e.g if allocation was unsuccessful.
Thus, it has no effect if the ID is not currently leased in the
pool, or the pool has since been refreshed.
Returns true if the ID was returned back to the pool as
a result of this call.