{"action":"Upgrade github.com/cilium/cilium to 1.17.16 or later.","affected":[{"fixed":"1.17.16","introduced":"0"},{"fixed":"1.18.10","introduced":"1.18.2"},{"fixed":"1.19.4","introduced":"1.19.0"}],"component":"github.com/cilium/cilium","cve_ids":["CVE-2026-53935"],"ecosystem":"Go","epss":0.0034,"exploited":false,"fixed_versions":["1.17.16","1.18.10","1.19.4"],"ghsa_id":"GHSA-q6h5-q3q6-f87x","id":"tcs_01M5KGQPNZ2VEET7FK6ASB603W","modified_at":"2026-07-14T10:11:29.500493636Z","published_at":"2026-07-07T15:26:37Z","references":["https://osv.dev/vulnerability/GO-2026-5914","https://github.com/cilium/cilium/security/advisories/GHSA-q6h5-q3q6-f87x","https://github.com/cilium/cilium/pull/44512","https://github.com/cilium/cilium/pull/44584","https://github.com/cilium/cilium/pull/44585"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GO-2026-5914","url":"https://osv.dev/vulnerability/GO-2026-5914"},{"source":"nvd","source_id":"CVE-2026-53935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53935"}],"summary":"CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation in github.com/cilium/cilium"}