Slack Nebula may accept arbitrary source IP addresses

MEDIO 4.9CVE-2025-62820 · GHSA-x6fh-7qmf-69xh · GO-2025-4068 · Published 23/10/2025 · updated 08/10/2026

In breve

CVE-2025-62820 è una vulnerabilità MEDIO (CVSS 4.9) che riguarda github.com/slackhq/nebula.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.22%, superiore al 12.6% delle vulnerabilità.
Correzione: aggiornare a 1.9.7 o successiva.

Package	Affected versions	Patched versions
github.com/slackhq/nebula Go	`≥ 1.9.4, < 1.9.7`	`1.9.7`

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

NVD description

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.