HIGHCVE-2026-25793Published Modified CNA GitHub_M
CVE-2026-25793: Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability
Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. This issue has been patched in version 1.10.3.
Metrics
- CVSS v4.0
- 7.6
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
Affected packages
- slackhq / nebula>= 1.7.0, < 1.10.3
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N