Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2025-23028

Medium
5.3/10

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A Denial of Service (DoS) vulnerability affects versions 1.14.0-snapshot.0 through 1.14.17, 1.15.0-pre.0 through 1.15.11, and 1.16.0-pre.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using a DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have a DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established. Still, new connections that rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent can restart.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • LOW

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published