CVE-2024-28248

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.13.9 and prior to versions 1.13.13, 1.14.8, and 1.15.2, Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. This issue has been patched in Cilium 1.15.2, 1.14.8, and 1.13.13. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-693

Affected software

Vendor	Product	Versions
cilium	cilium	>= 1.13.9, < 1.13.13; >= 1.14.0, < 1.14.8; >= 1.15.0, < 1.15.2

References

https://docs.cilium.io/en/stable/security/policy/language/#httpProduct
https://github.com/cilium/cilium/releases/tag/v1.13.13Release Notes
https://github.com/cilium/cilium/releases/tag/v1.14.8Release Notes
https://github.com/cilium/cilium/releases/tag/v1.15.2Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-68mj-9pjq-mc85Vendor Advisory
https://docs.cilium.io/en/stable/security/policy/language/#httpProduct
https://github.com/cilium/cilium/releases/tag/v1.13.13Release Notes
https://github.com/cilium/cilium/releases/tag/v1.14.8Release Notes
https://github.com/cilium/cilium/releases/tag/v1.15.2Release Notes
https://github.com/cilium/cilium/security/advisories/GHSA-68mj-9pjq-mc85Vendor Advisory

Timeline

Published: Mar 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-282496.1Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in CVE-2024-28258.8A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /urepo CVE-2024-282506.1Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions CVE-2024-282517.3Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality CVE-2024-282527.5CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. If you have a NetFraming based CoreWCF service CVE-2024-282538.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-282548.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-282559.8OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, CVE-2024-28268.8A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the fi CVE-2024-282659.1IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.CVE-2024-282697.2ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server. The file upload is not restricted, leading to the ability CVE-2024-28278.8A vulnerability, which was classified as critical, has been found in lakernote EasyAdmin up to 20240315. This issue affects some unknown pro