slackhq vulnerabilities

Products

• github.com/slackhq/nebula 2

Latest slackhq CVEs

Newest publication first

1. CVE-2026-25793 Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability

   Published 2026-02-06

   High·CVSS 7.6 EPSS 0.14%

   Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability...

2. CVE-2025-62820 Slack Nebula may accept arbitrary source IP addresses

   Published 2025-10-23

   Medium·CVSS 4.9 EPSS 0.22%

   Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.