Linux Distros Unpatched Vulnerability : CVE-2025-22021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: socket: Lookup orig tuple for IPv6 SNAT nfsklookupslowv4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, ...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: rancher-fleet, k8ssandra-client, zarf, flux-source-controller, istio, chart-testing, envoy-gateway, k9s, pluto, cilium-cli, kots, rancher-helm, cerbos, k8sgpt, helm-operator, tw, cert-manager-cmctl, zot, chartmuseum, eksctl, helm-docs, kargo, linkerd2, trivy,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: rancher-fleet, k8ssandra-client, zarf, flux-source-controller, istio, chart-testing, envoy-gateway, k9s, pluto, cilium-cli, kots, rancher-helm, cerbos, k8sgpt, helm-operator, tw, cert-manager-cmctl, zot, chartmuseum, eksctl, helm-docs, kargo, linkerd2, trivy,...

CVE-2025-53547 vulnerabilities

Vulnerabilities for packages: helm-operator, cilium-cli, kots, rancher-fleet, harbor, helm-operator-fips, chart-testing-fips, flux-helm-controller-fips, trivy-fips, zot, linkerd2, chart-testing, zarf, chartmuseum-fips, envoy-gateway-fips, rancher-helm, rancher-fleet-fips, chartmuseum, istio,...

GHSA-557J-XG8C-Q2MM vulnerabilities

Vulnerabilities for packages: helm-operator, cilium-cli, kots, rancher-fleet, harbor, helm-operator-fips, chart-testing-fips, flux-helm-controller-fips, trivy-fips, zot, linkerd2, chart-testing, zarf, chartmuseum-fips, envoy-gateway-fips, rancher-helm, rancher-fleet-fips, chartmuseum, istio,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: vmxnet3: Fixed malformed packet sizes in vmxnet3processxdp. The XDP handling of the vmxnet3 driver is buggy for packet sizes using ring0 i.e., packet sizes between 128 and 3k bytes. We noticed connectivity issues related to MT...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Scrubbing packets on bpfredirectpeer When bpfredirectpeer is used to redirect packets to a device in another network namespace, the packets are not scrubbed. This can lead to information about the packets being “misused” in...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT The nfsklookupslowv4 function performs the conntrack lookup for IPv4 packets in order to restore the original 5-tuple in case of SNAT, so that the correct socket if any can be...

CVE-2025-4673 vulnerabilities

Vulnerabilities for packages: gatus, prometheus-adapter, step-issuer, whereabouts, dynamic-localpv-provisioner, kubernetes-csi-external-provisioner, amazon-k8s-cni, mockgen, docker-cli-buildx, metallb, k8ssandra-operator, falcosidekick, fixuid, sftpgo, velero-plugin-for-microsoft-azure,...

The vulnerability of the DNS server software used for network security in Cilium allows a attacker to cause a service failure.

The vulnerability of the DNS server used by the Cilium networking security software is related to the unlimited distribution of resources during the processing of the DNSZombieMapping list. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

Control Character Injection

github.com/cilium/hubble is vulnerable to control character injection. The vulnerability is due to improper sanitization of control characters in the terminal output when monitoring Kafka traffic using Layer 7 Protocol Visibility and allows an attacker to manipulate output, conceal log entries, o...

GO-2025-3700 Character injection in Hubble CLI in github.com/cilium/hubble

Character injection in Hubble CLI in github.com/cilium/hubble...

CVE-2025-23028

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an...

CVE-2024-47825

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

CVE-2024-42487

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular,...

CVE-2024-52529

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the first policy's range...

CVE-2024-25631

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. This issue affects Cilium v1.14 before v1.14.7 and...

CVE-2024-25630

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affect...

CVE-2024-42488

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies...

CVE-2024-28249

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters with IPsec enabled and traffic matching Layer 7 policies, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes is sen...