Cloudanix VulnDB

CVE-2026-25793

High · 8.1

CVSS

8.1

EPSS

0.2%

Published

Feb 6, 2026

CISA due date

—

The record

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/slackhq/nebula 1.7.0 1.10.3
Chainguard caddy 0 2.11.0-r0
Chainguard caddy-fips 0 2.11.1-r0
Chainguard step 0 0.30.1-r0
Chainguard step-ca 0 0.30.1-r0
Chainguard step-ca-fips 0 0.30.2-r0
Chainguard step-fips 0 0.30.1-r0
Chainguard step-issuer 0 0.10.1-r0
Chainguard step-issuer-fips 0 0.9.11-r5
Wolfi caddy 0 2.11.0-r0
Wolfi step 0 0.30.1-r0
Wolfi step-ca 0 0.30.1-r0
Wolfi step-issuer 0 0.10.1-r0
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260226T182644-150000.1.149.1

Related vulnerabilities