CVE-2025-62820

Name
CVE-2025-62820
Description
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
https://github.com/slackhq/nebula/pull/1493
https://github.com/slackhq/nebula/pull/1494

Match rules

CPE URI Source package Min version Max version
nebula >= 0 < 1.9.7

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nebula edge-community 1.9.6-r3 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.6-r2 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.6-r1 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.6-r0 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.5-r4 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.5-r3 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.5-r2 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.5-r1 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.5-r0 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.4-r2 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.4-r1 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.9.4-r0 TBK <alpine@jjtc.eu> possibly vulnerable
nebula edge-community 1.8.1-r0 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.9.5-r7 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.9.5-r6 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.9.5-r5 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.9.5-r4 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.9.4-r5 TBK <alpine@jjtc.eu> possibly vulnerable
nebula 3.22-community 1.8.1-r0 None possibly vulnerable