Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/slackhq/nebula

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6GoPublished

    Blocklist Bypass possible via ECDSA Signature Malleability

    CVE-2026-25793 · GHSA-69x3-g4r3-p962

    Affected
    • Go github.com/slackhq/nebula >= 1.7.0, <= 1.10.2
    Fixed in
    1.10.3· Vendor fix available
    Issue
    Impact When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. In order for this to affect a user or network, all of the following must be true: CURVEP256 certificates are being used There are one or more entries on the blocklist The certificates for those entries are signed by a trusted CA and not expired An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries Patches See attached Workarounds If full copies of each certificate on the existing blocklist are available, it is possible to compute their opposite-chirality signature, and then the appropriate second fingerprint to list in the blocklist. Rotating out all CAs that have signed hosts on the blocklist will also prevent exploitation of this vulnerability.

    Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 4.9GoPublished

    Slack Nebula may accept arbitrary source IP addresses

    CVE-2025-62820 · GHSA-x6fh-7qmf-69xh

    Affected
    • Go github.com/slackhq/nebula >= 1.9.4, < 1.9.7
    Fixed in
    1.9.7· Vendor fix available
    Issue
    Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

    Recommended action: Upgrade to 1.9.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →