CVE-2025-23028
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
CVE-2025-23028- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-0150
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
EUVD-2025-0150- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9m5p-c77c-f9j7
DoS in Cilium agent DNS proxy from crafted DNS responses
Impact
In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster.
For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart.
Patches
This issue affects:
- Cilium v1.14 between v1.14.0 and v1.14.17 inclusive
- Cilium v1.15 between v1.15.0 and v1.15.11 inclusive
- Cilium v1.16 between v1.16.0 and v1.16.4 inclusive
This issue is fixed in:
- Cilium v1.14.18
- Cilium v1.15.12
- Cilium v1.16.5
Workarounds
There are no known workarounds to this issue.
Acknowledgements
The Cilium community has worked together with members of Isovalent and the Cisco Advanced Security Initiatives Group (ASIG) to prepare these mitigations. Special thanks to @kokelley-cisco for reporting this issue and @bimmlerd for the fix.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
- Record
GHSA-9m5p-c77c-f9j7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
CVE-2025-23028- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
CVE-2025-23028- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-9m5p-c77c-f9j7
DoS in Cilium agent DNS proxy from crafted DNS responses
Impact
In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster.
For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart.
Patches
This issue affects:
- Cilium v1.14 between v1.14.0 and v1.14.17 inclusive
- Cilium v1.15 between v1.15.0 and v1.15.11 inclusive
- Cilium v1.16 between v1.16.0 and v1.16.4 inclusive
This issue is fixed in:
- Cilium v1.14.18
- Cilium v1.15.12
- Cilium v1.16.5
Workarounds
There are no known workarounds to this issue.
Acknowledgements
The Cilium community has worked together with members of Isovalent and the Cisco Advanced Security Initiatives Group (ASIG) to prepare these mitigations. Special thanks to @kokelley-cisco for reporting this issue and @bimmlerd for the fix.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
- Record
GHSA-9m5p-c77c-f9j7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-cilium-2025-23028 No score
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
BIT-cilium-2025-23028- Updated
- 2026-11-02
OSVBIT-cilium-operator-2025-23028 No score
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
BIT-cilium-operator-2025-23028- Updated
- 2026-11-02
OSVBIT-hubble-relay-2025-23028 No score
DoS in Cilium agent DNS proxy from crafted DNS responses
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.
- Record
BIT-hubble-relay-2025-23028- Updated
- 2026-11-02
OSVGO-2025-3415 No score
DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
DoS in Cilium agent DNS proxy from crafted DNS responses in github.com/cilium/cilium
- Record
GO-2025-3415- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14710-1 No score
govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14710-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0297-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
-
Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
- GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
- GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
- GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
- GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
- GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
- GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
- GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
- GO-2025-3422 CVE-2025-24354
-
Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3372 CVE-2024-45339
- GO-2025-3373 CVE-2024-45341
- GO-2025-3383 CVE-2024-45340
- GO-2025-3420 CVE-2024-45336
- GO-2025-3421 CVE-2025-22865
-
Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
- GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
- GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
- GO-2025-3396 CVE-2024-52594
- GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
- GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
- GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
- GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
- GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
- GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997
-
Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
- GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
- GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
- GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
- GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9
-
Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
- GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
- GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
- GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79
- Record
SUSE-SU-2025:0297-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cilium/ciliumGo |
1.14.0 up to 1.14.18 | 1.14.18 |
github.com/cilium/ciliumGo |
1.15.0 up to 1.15.12 | 1.15.12 |
github.com/cilium/ciliumGo |
1.16.0 up to 1.16.5 | 1.16.5 |
ciliumBitnami |
1.15.4 up to 1.16.5 | 1.16.5 |
cilium-operatorBitnami |
1.15.4 up to 1.16.5 | 1.16.5 |
hubble-relayBitnami |
1.14.0 up to 1.16.5 | 1.16.5 |
github.com/cilium/ciliumGo |
1.14.0 up to 1.14.18, 1.15.0 up to 1.15.12, 1.16.0 up to 1.16.5 | 1.14.181.15.121.16.5 |
govulncheck-vulndbSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 33 CVEs |
before 0.0.20250128T150132-150000.1.29.1 | 0.0.20250128T150132-150000.1.29.1 |
govulncheck-vulndbopenSUSE:Leap 15.6 From an advisory covering 33 CVEs |
before 0.0.20250128T150132-150000.1.29.1 | 0.0.20250128T150132-150000.1.29.1 |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 0.0.20250128T150132-1.1 | 0.0.20250128T150132-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23028 is a medium vulnerability (CVSS 5.3) in Cilium, published January 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in github.com/cilium/cilium 1.14.18.
References
github.com/cilium/cilium/security/advisories/GHSA-9m5p-c77c-f9j7
nvd.nist.gov/vuln/detail/CVE-2025-23028
Show 36 moreShow less
suse.com/support/update/announcement/2025/suse-su-20250297-1