CVE-2025-23028

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23028", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-01-10T15:11:08.881Z", "datePublished": "2025-01-22T16:48:19.722Z", "dateUpdated": "2025-02-18T19:38:18.151Z"}, "containers": {"cna": {"title": "DoS in Cilium agent DNS proxy from crafted DNS responses", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7"}, {"name": "https://github.com/cilium/cilium/pull/36252", "tags": ["x_refsource_MISC"], "url": "https://github.com/cilium/cilium/pull/36252"}], "affected": [{"vendor": "cilium", "product": "cilium", "versions": [{"version": ">= 1.14.0, < 1.14.18", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.12", "status": "affected"}, {"version": ">= 1.16.0, < 1.16.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-22T16:48:19.722Z"}, "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available."}], "source": {"advisory": "GHSA-9m5p-c77c-f9j7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-22T17:01:24.770374Z", "id": "CVE-2025-23028", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T19:38:18.151Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23028", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-22T17:01:24.770374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-22T17:02:31.342Z"}}], "cna": {"title": "DoS in Cilium agent DNS proxy from crafted DNS responses", "source": {"advisory": "GHSA-9m5p-c77c-f9j7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "cilium", "product": "cilium", "versions": [{"status": "affected", "version": ">= 1.14.0, < 1.14.18"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.12"}, {"status": "affected", "version": ">= 1.16.0, < 1.16.5"}]}], "references": [{"url": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7", "name": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cilium/cilium/pull/36252", "name": "https://github.com/cilium/cilium/pull/36252", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-01-22T16:48:19.722Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23028", "state": "PUBLISHED", "dateUpdated": "2025-02-18T19:38:18.151Z", "dateReserved": "2025-01-10T15:11:08.881Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-01-22T16:48:19.722Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "cilium", "vendor": "cilium", "versions": [{"status": "affected", "version": ">= 1.14.0, < 1.14.18"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.12"}, {"status": "affected", "version": ">= 1.16.0, < 1.16.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DE305E9-5474-4A62-B9D7-2AC0B298A5EA", "versionEndExcluding": "1.14.18", "versionStartIncluding": "1.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "2E5E6391-00DF-4FE0-BE74-72D8443487D2", "versionEndExcluding": "1.15.12", "versionStartIncluding": "1.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FDD07F7-2633-4EB1-AEC1-1F7561D7DDCA", "versionEndExcluding": "1.16.5", "versionStartIncluding": "1.16.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available."}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Una vulnerabilidad de denegaci\u00f3n de servicio afecta a las versiones 1.14.0 a 1.14.7, 1.15.0 a 1.15.11 y 1.16.0 a 1.16.4. En un cl\u00faster de Kubernetes donde Cilium est\u00e1 configurado para actuar como proxy del tr\u00e1fico DNS, un atacante puede bloquear los agentes de Cilium enviando una respuesta DNS manipulado a las cargas de trabajo desde fuera del cl\u00faster. Para el tr\u00e1fico permitido pero sin utilizar una pol\u00edtica basada en DNS, el plano de datos seguir\u00e1 pasando el tr\u00e1fico tal como se configur\u00f3 en el momento del ataque de denegaci\u00f3n de servicio. Para las cargas de trabajo que tienen configurada una pol\u00edtica basada en DNS, las conexiones existentes pueden seguir funcionando y las nuevas conexiones realizadas sin depender de la resoluci\u00f3n DNS pueden seguir estableci\u00e9ndose, pero las nuevas conexiones que dependen de la resoluci\u00f3n DNS pueden verse interrumpidas. Es posible que los cambios de configuraci\u00f3n que afecten al agente afectado no se apliquen hasta que el agente pueda reiniciarse. Este problema se solucion\u00f3 en Cilium v1.14.18, v1.15.12 y v1.16.5. No hay workarounds disponibles."}], "id": "CVE-2025-23028", "lastModified": "2026-06-17T08:51:32.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23028", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-22T17:01:24.770374Z", "version": "2.0.3"}}]}, "published": "2025-01-22T17:15:13.487", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cilium/cilium/pull/36252"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:18.293731+00:00", "updated": "2025-07-12T15:26:18.293782+00:00", "vendors": ["cilium", "cilium$PRODUCT$cilium"]}