CVE-2026-25793
ECDSA Signature Malleability Allows Blocklist Bypass in Nebula
Publication date: 2026-02-06
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| slack | nebula | From 1.7.0 (inc) to 1.10.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Nebula, a scalable overlay networking tool, in versions 1.7.0 to 1.10.2 when using P256 certificates, which is not the default configuration.
The issue involves ECDSA Signature Malleability, which allows an attacker to evade a blocklist entry created against the fingerprint of a certificate by using a copy of the certificate with a different fingerprint.
This means that even if a certificate is blocked based on its fingerprint, an attacker can manipulate the signature to create a different fingerprint and bypass the blocklist.
The vulnerability was fixed in Nebula version 1.10.3.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass security controls that rely on certificate fingerprint blocklists.
As a result, unauthorized or malicious certificates could be used to gain access or communicate within the Nebula network despite being blocked.
This could lead to potential unauthorized access, data interception, or other security breaches within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Nebula to version 1.10.3 or later where the issue has been patched.