medium4.9
CVE-2025-62820
Slack Nebula may accept arbitrary source IP addresses
Impact
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/slackhq/nebula | >= 1.9.4, < 1.9.7 | 1.9.7 |
Affected products
| Product | Affected versions |
|---|---|
| Slack Nebula | before 1.9.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/slackhq/nebula/pull/1493
- https://github.com/slackhq/nebula/pull/1494
- https://github.com/advisories/GHSA-x6fh-7qmf-69xh
- https://nvd.nist.gov/vuln/detail/CVE-2025-62820
- https://github.com/slackhq/nebula/commit/e264a0ff888c7bf0568579306755a60fc42f6ecc