CVE-2025-62820: Medium severity Slack Nebula vulnerability
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/slackhq/nebulato a version that resolves this vulnerability.Fixed in 1.9.7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62820?
CVE-2025-62820 is classified as a critical vulnerability due to its potential to allow arbitrary source IP addresses within the Nebula network.
How do I fix CVE-2025-62820?
To fix CVE-2025-62820, upgrade Slack Nebula to version 1.9.7 or later.
What impact does CVE-2025-62820 have on Slack Nebula?
CVE-2025-62820 can allow unauthorized access by accepting arbitrary source IP addresses in certain configurations.
In which versions of Slack Nebula is CVE-2025-62820 present?
CVE-2025-62820 is present in all versions of Slack Nebula prior to 1.9.7.
How can I determine if I am affected by CVE-2025-62820?
You can determine if you are affected by CVE-2025-62820 by checking your version of Slack Nebula and ensuring it is 1.9.7 or newer.