GHSA-x6fh-7qmf-69xh

Source

https://github.com/advisories/GHSA-x6fh-7qmf-69xh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-x6fh-7qmf-69xh/GHSA-x6fh-7qmf-69xh.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-x6fh-7qmf-69xh

Aliases

CVE-2025-62820

Downstream

MINI-cw98-4w4w-c78v

Related

Published

2025-10-23T06:31:00Z

Modified

2025-10-23T17:27:49.381515Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

Slack Nebula may accept arbitrary source IP addresses

Details

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Database specific

{
    "nvd_published_at": "2025-10-23T04:18:57Z",
    "cwe_ids": [
        "CWE-420"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2025-10-23T16:49:07Z",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/slackhq/nebula

Package

Name: github.com/slackhq/nebula; View open source insights on deps.dev
Purl: pkg:golang/github.com/slackhq/nebula

Affected ranges

Type: SEMVER
Events: Introduced

1.9.4

Fixed

1.9.7