CVE-2025-62820
Medium · 4.9CVSS
4.9
EPSS
0.2%
Published
Oct 23, 2025
CISA due date
—
The record
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/slackhq/nebula | 1.9.4 | 1.9.7 |
| Chainguard | caddy | 0 | 2.10.2-r3 |
| Chainguard | caddy-fips | 0 | 2.10.2-r2 |
| Chainguard | caddy-man | 0 | 2.10.2-r3 |
| Chainguard | caddy-src | 0 | 2.10.2-r3 |
| Chainguard | step | 0 | 0.28.7-r4 |
| Chainguard | step-ca | 0 | 0.28.4-r3 |
| Chainguard | step-ca-fips | 0 | 0.28.4-r4 |
| Chainguard | step-fips | 0 | 0.28.7-r4 |
| Chainguard | step-issuer | 0 | 0.9.9-r3 |
| Chainguard | step-issuer-compat | 0 | 0.9.9-r3 |
| Chainguard | step-issuer-fips | 0 | 0.9.9-r3 |
| Chainguard | step-issuer-fips-compat | 0 | 0.9.9-r3 |
| Wolfi | caddy | 0 | 2.10.2-r3 |
| Wolfi | caddy-man | 0 | 2.10.2-r3 |
| Wolfi | caddy-src | 0 | 2.10.2-r3 |
| Wolfi | step | 0 | 0.28.7-r4 |
| Wolfi | step-ca | 0 | 0.28.4-r3 |
| Wolfi | step-issuer | 0 | 0.9.9-r3 |
| Wolfi | step-issuer-compat | 0 | 0.9.9-r3 |
| go | github.com/slackhq/nebula | 1.9.4 | 1.9.7 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0 | 0.0.20251105T184115-1.1 |
Related vulnerabilities
- CVE-2026-25793 Nebula is a scalable overlay networking tool. Also affects github.com/slackhq/nebula
- CVE-2026-34986 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of… Also affects caddy
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects caddy
- CVE-2026-30836 Step CA is an online certificate authority for secure, automated certificate management… Also affects caddy
- CVE-2026-27141 Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to… Also affects caddy
- CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects caddy
- CVE-2025-44005 An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner… Also affects caddy
- CVE-2025-64702 quic-go is an implementation of the QUIC protocol in Go. Also affects caddy