VDB

GHSA-qcm3-7879-xcww

GHSA-qcm3-7879-xcww PUBLISHED CVSS 4 MEDIUM

Gateway API route matching order contradicts specification

Record from GitHub Advisory Database · Published August 15, 2024

github.com/cilium/cilium is fixed in 1.16.1 and 1.15.8 (Go Modules)

Gateway API route matching order contradicts specification

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
github.com/cilium/ciliumGo Modules1.16.1, 1.15.8
hubble-fipsChainguard1.16.0-r1
cilium-1.15Wolfi1.15.19-r3
cilium-cliWolfi0.16.15-r2
hubble-uiChainguard0.13.1-r5
cilium-cliChainguard0.16.15-r2
cilium-1.15Chainguard1.15.19-r3
hubbleWolfi1.16.0-r1
hubble-ui-backendChainguard0.13.1-r5
cilium-1.16Wolfi1.16.1-r0
hubble-uiWolfi0.13.1-r5
cilium-1.16Chainguard1.16.1-r0

4 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected products

VendorProductVersions
chainguardhubble-fips0
wolficilium-1.150
wolficilium-cli0
chainguardhubble-ui0
chainguardcilium-cli0
chainguardcilium-1.150
wolfihubble0
chainguardhubble-ui-backend0
wolficilium-1.160
wolfihubble-ui0
chainguardcilium-1.160
chainguardhubble-ui-backend-fips0
chainguardhubble0
chainguardcilium-fips-1.150
github.comcilium/cilium1.16.0, 1.15.0, 1.16.0
chainguardcilium-fips-1.160

Timeline

  • Aug 15, 2024 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-qcm3-7879-xcww
vulnetix vdb fixes GHSA-qcm3-7879-xcww

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-qcm3-7879-xcww/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›