TI-2024-35199 Aliases CVE-2024-52529 GHSA-xg58-75qf-9r67

Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

LOW 33CWE-755Published 2024-11-25 · Updated 2024-11-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range `AND` 2. A Layer 7 allow policy that selects a specific port within the first policy's range the Layer 7 enforcement would not occur for the traffic selected by the Layer 7 policy. This issue only affects users who use Cilium's port range functionality, which was introduced in Cilium v1.16. This issue is patched in PR #35150. This issue affects Cilium v1.16 between v1.16.0 and v1.16.3 inclusive. This issue is patched in Cilium v1.16.4. Users are advised to upgrade. Users with network policies that match the pattern described above can work around the issue by rewriting any policies that use port ranges to individually specify the ports permitted for traffic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0052 44th percentileScored 2026-11-07

Fix Fixed cilium (cilium): 1.16.4github.com/cilium/cilium (Go): 1.16.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cilium	cilium	1.16.0 to before 1.16.4	1.16.4	Patch available	CNA
—	github.com/cilium/cilium (Go)	1.16.0 to before 1.16.4	1.16.4	Patch available	GHSA-xg58-75qf-9r67

cilium Vendorcilium Affected 1.16.0 to before 1.16.4 Fixed in 1.16.4 Patch available CNA
github.com/cilium/cilium (Go) Vendor— Affected 1.16.0 to before 1.16.4 Fixed in 1.16.4 Patch available GHSA-xg58-75qf-9r67

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cilium:cilium::::::::	1.16.0 to before 1.16.4	Vulnerable	cilium

cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:* Versions 1.16.0 to before 1.16.4 Vulnerable ·cilium

Remediation

Fix · CNA cilium (cilium) Fixed in 1.16.4
Fix · GHSA-xg58-75qf-9r67 github.com/cilium/cilium (Go) Fixed in 1.16.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-52529
2026-10-03 Alias added: GHSA-xg58-75qf-9r67

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-52529

Other 1

https://github.com/cilium/cilium

TI-2024-32092 CIDR deny policies may not take effect when a more narrow CIDR allow is present CVSS 3.1HIGH 8.7
TI-2023-12305 Cilium eBPF filters may be temporarily removed during agent restart CVSS 3.1CRITICAL 9.8
TI-2023-20486 Cilium NetworkPolicy bypass via pod labels CVSS 3.1CRITICAL 9.0
TI-2022-11721 Incorrect Default Permissions in Cilium CVSS 3.1HIGH 8.8
TI-2026-36600 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access CVSS 3.1CRITICAL 9.2
TI-2026-40915 Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces CVSS 3.1HIGH 8.9

See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences