CVE-2024-42487 - CVE House

Back to Database

Status published Medium CVE-2024-42487

Cilium's Gateway API route matching order contradicts specification

4 CVSS

Vulnerability Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In the 1.15 branch prior to 1.15.8 and the 1.16 branch prior to 1.16.1, Gateway API HTTPRoutes and GRPCRoutes do not follow the match precedence specified in the Gateway API specification. In particular, request headers are matched before request methods, when the specification describes that the request methods must be respected before headers are matched. This could result in unexpected behaviour with security This issue is fixed in Cilium v1.15.8 and v1.16.1. There is no workaround for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42487

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from cilium

View All →

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic

Hubble CLI vulnerable to character injection

Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Node based network policies may incorrectly allow workload traffic

East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

Affected Vendor

cilium

View all reports →

Affected Software

cilium

Vulnerable Versions:

= 1.16.0, >= 1.15.0, < 1.15.8

Timeline

Official Publish: August 15th, 2024

Last Modified: August 15th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.