{"id":"GO-2026-5255","revision":"0d4ec8508dc04e84bebb1d7ed70638df","records":[{"revision":"0d4ec8508dc04e84bebb1d7ed70638df","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5255","aliases":["CVE-2026-48025","GHSA-8h84-fhqq-q58v"],"title":"nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh","description":"nebula-mesh: Decrypted CA private key persists in heap after signing in github.com/forgekeep/nebula-mesh","state":0,"publishedAt":"2026-06-25T18:43:15+00:00","modifiedAt":"2026-06-25T19:45:22.8533343+00:00","affected":[{"ecosystem":"Go","name":"github.com/forgekeep/nebula-mesh","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.3.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/juev/nebula-mesh/security/advisories/GHSA-8h84-fhqq-q58v","https://github.com/forgekeep/nebula-mesh/commit/bca1d5914fbaf3517d3b86145a802c00de4a8122","https://github.com/forgekeep/nebula-mesh/releases/tag/v0.3.7"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5255","license":"OSV · upstream source license applies","key":"osv:GO-2026-5255","identifiers":["GO-2026-5255","CVE-2026-48025","GHSA-8h84-fhqq-q58v"]},"retained":false,"historicalAffected":[]}],"coverage":[]}