Slack Nebula may accept arbitrary source IP addresses

MEDIUM 4.9CVE-2025-62820 · GHSA-x6fh-7qmf-69xh · GO-2025-4068 · Published 23/10/2025 · updated 08/10/2026

In short

CVE-2025-62820 is a MEDIUM (CVSS 4.9) vulnerability affecting github.com/slackhq/nebula.
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.6% of all vulnerabilities.
Fix: update to 1.9.7 or later.

Package	Affected versions	Patched versions
github.com/slackhq/nebula Go	`≥ 1.9.4, < 1.9.7`	`1.9.7`

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

NVD description

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.