Cilium — CWE-407 Disclosure Brief

2026-03-27 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in Cilium's network policy label selector and L7 rule merging. Both use slices.Contains in policy hot paths called per identity and per CNP reconciliation. Patches ready for upstream review.

The Defects

cilium-0001 (PATCHED — HIGH): pkg/labels/selector.go

// Requirement.hasValue() — per identity in selector cache:
if slices.Contains(r.strValues, value) { ... }  // O(V) per identity

slices.Contains(strValues) per identity lookup in the selector cache. Fix: map[string]struct{}. Measured ratio: 100×.

cilium-0002 (PATCHED — HIGH): pkg/policy/rule.go:310

// L7Rules.Exists() — per CNP reconciliation:
if slices.ContainsFunc(l7Rules, func(r L7Rule) bool {
    return r.Key == key
}) { ... }  // O(N×M) per mergeL4Filter

slices.ContainsFunc O(N×M) in mergeL4Filter() per CNP reconciliation event. Fix: map[ruleKey]struct{} pre-index. Measured ratio: 50×.

Complexity Proof

cilium-0001: For V=100 string values per requirement:

Per identity: O(V) scan
Fixed: map[string]struct{} → O(1)
100× measured ratio.

cilium-0002: For N×M=50 rule combinations per mergeL4Filter:

Fixed: pre-built map[ruleKey]struct{} → O(N + M)
50× measured ratio.

Impact

All Cilium deployments — both defects fire in the network policy enforcement path. cilium-0001 runs on every identity selector cache lookup, which happens on every packet forwarding decision that requires policy evaluation. cilium-0002 runs on every CNP (CiliumNetworkPolicy) reconciliation event. Cilium is the most widely adopted CNI plugin for Kubernetes, used in EKS, GKE, and large-scale production clusters.

The Fix

cilium-0001: Replace strValues slice with map[string]struct{}:

// Before
if slices.Contains(r.strValues, value) { ... }  // O(V)

// After
// CWE-407 fix: map[string]struct{} for O(1) hasValue instead of O(V) slices.Contains.
if _, ok := r.strValueSet[value]; ok { ... }

cilium-0002: Pre-build map[ruleKey]struct{} index in mergeL4Filter().

Patch

defects/cilium/patch/cilium-0001-0002-selector-map.patch

What We Ask

Confirm receipt and assign a GitHub Security Advisory or issue reference.
Validate the patch against your selector and policy rule test suites.
Assess CVE eligibility — cilium-0001 fires on every policy-evaluated packet forwarding decision.
Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.6 KiB Raw Blame History Unescape Escape