{"id":"GHSA-x6fh-7qmf-69xh","revision":"7002ba5e162c4fe0ba39e17a67c3df82","records":[{"revision":"7002ba5e162c4fe0ba39e17a67c3df82","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-x6fh-7qmf-69xh","aliases":["CVE-2025-62820","GO-2025-4068"],"title":"Slack Nebula may accept arbitrary source IP addresses ","description":"Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.","state":0,"publishedAt":"2025-10-23T06:31:00+00:00","modifiedAt":"2026-09-10T03:50:30.4060594+00:00","affected":[{"ecosystem":"Go","name":"github.com/slackhq/nebula","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.9.4"},{"kind":"fixed","version":"1.9.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-62820","https://github.com/slackhq/nebula/pull/1493","https://github.com/slackhq/nebula/pull/1494","https://github.com/slackhq/nebula/commit/e264a0ff888c7bf0568579306755a60fc42f6ecc","https://github.com/slackhq/nebula"],"sourceUrl":"https://github.com/advisories/GHSA-x6fh-7qmf-69xh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x6fh-7qmf-69xh","identifiers":["GHSA-x6fh-7qmf-69xh","CVE-2025-62820","GO-2025-4068"]},"retained":false,"historicalAffected":[]}],"coverage":[]}