Affected by GO-2022-0393
and 17 other vulnerabilities
GO-2022-0393: Network policy may be bypassed by some ICMP Echo Requests in github.com/cilium/cilium
GO-2022-0457: Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium
GO-2022-0458: Improper Privilege Management in Cilium in github.com/cilium/cilium
GO-2022-0959: Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium
GO-2023-1643: Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
GO-2023-1730: Debug mode leaks confidential data in Cilium in github.com/cilium/cilium
GO-2023-1785: Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium
GO-2023-2078: Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
GO-2023-2079: Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
GO-2023-2080: Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
GO-2024-2656: Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
GO-2024-2666: Insecure IPsec transparent encryption in github.com/cilium/cilium
GO-2024-3072: Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
GO-2025-4167: Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium
GO-2026-4856: Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic in github.com/cilium/cilium
GO-2026-5400: Cillium exposes sensitive information included in the cilium-bugtool debug archive in github.com/cilium/cilium
GO-2026-5905: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access in github.com/cilium/cilium
GO-2026-5914: CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium
Package rate provides a rate limiter to rate limit requests that can be
burstable but they should only allowed N per a period defined.
This package differs from the "golang.org/x/time/rate" package as it does not
implement the token bucket algorithm.
NewLimiter returns a new Limiter that allows events up to b tokens during
the given interval.
This Limiter has a different implementation from the 'x/time/rate's Limiter
implementation. 'x/time/rate.Limiter' sends a constant stream of updates
(at a rate of few dozen events per second) over the period of a N minutes
which is the behavior of the token bucket algorithm. It is designed to
flatten bursts in a signal to a fixed output rate.
This rate.Limiter does the opposite of 'x/time/rate.Limiter'. It takes a
somewhat fixed-rate stream of updates and turns it into a stream of
controlled small bursts every N minutes.
WaitN acquires n tokens, blocking until resources are available or ctx is
done. On success, returns nil. On failure, returns ctx.Err() and leaves the
limiter unchanged.
If ctx is already done, WaitN may still succeed without blocking.
Affected by 
Documentation
¶
Source Files