# Cilium — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

Two O(n²) defects in Cilium's network policy label selector and L7 rule merging. Both use `slices.Contains` in policy hot paths called per identity and per CNP reconciliation. Patches ready for upstream review.

## The Defects

**cilium-0001 (PATCHED — HIGH):** `pkg/labels/selector.go`

```go
// Requirement.hasValue() — per identity in selector cache:
if slices.Contains(r.strValues, value) { ... }  // O(V) per identity
```

`slices.Contains(strValues)` per identity lookup in the selector cache. Fix: `map[string]struct{}`. **Measured ratio: 100×.**

**cilium-0002 (PATCHED — HIGH):** `pkg/policy/rule.go:310`

```go
// L7Rules.Exists() — per CNP reconciliation:
if slices.ContainsFunc(l7Rules, func(r L7Rule) bool {
    return r.Key == key
}) { ... }  // O(N×M) per mergeL4Filter
```

`slices.ContainsFunc` O(N×M) in `mergeL4Filter()` per CNP reconciliation event. Fix: `map[ruleKey]struct{}` pre-index. **Measured ratio: 50×.**

## Complexity Proof

**cilium-0001:** For V=100 string values per requirement:
- Per identity: O(V) scan
- Fixed: `map[string]struct{}` → O(1)
- **100× measured ratio.**

**cilium-0002:** For N×M=50 rule combinations per `mergeL4Filter`:
- Fixed: pre-built `map[ruleKey]struct{}` → O(N + M)
- **50× measured ratio.**

## Impact

All Cilium deployments — both defects fire in the network policy enforcement path. cilium-0001 runs on every identity selector cache lookup, which happens on every packet forwarding decision that requires policy evaluation. cilium-0002 runs on every CNP (CiliumNetworkPolicy) reconciliation event. Cilium is the most widely adopted CNI plugin for Kubernetes, used in EKS, GKE, and large-scale production clusters.

## The Fix

**cilium-0001:** Replace `strValues` slice with `map[string]struct{}`:

```go
// Before
if slices.Contains(r.strValues, value) { ... }  // O(V)

// After
// CWE-407 fix: map[string]struct{} for O(1) hasValue instead of O(V) slices.Contains.
if _, ok := r.strValueSet[value]; ok { ... }
```

**cilium-0002:** Pre-build `map[ruleKey]struct{}` index in `mergeL4Filter()`.

## Patch

`defects/cilium/patch/cilium-0001-0002-selector-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your selector and policy rule test suites.
3. Assess CVE eligibility — cilium-0001 fires on every policy-evaluated packet forwarding decision.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
