{"id":"CVE-2026-25793","aliases":["GHSA-69x3-g4r3-p962","GO-2026-4458"],"title":"Blocklist Bypass possible via ECDSA Signature Malleability","summary":"Blocklist Bypass possible via ECDSA Signature Malleability","severity":"high","vendor":"slackhq","product":"github.com/slackhq/nebula","ecosystem":"go","affected":["github.com/slackhq/nebula >= 1.7.0, < 1.10.3"],"patched":["github.com/slackhq/nebula 1.10.3"],"published":"2026-02-06","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:48.430160154Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-69x3-g4r3-p962","references":[{"url":"https://github.com/slackhq/nebula/security/advisories/GHSA-69x3-g4r3-p962"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25793"},{"url":"https://github.com/slackhq/nebula/commit/f573e8a26695278f9d71587390fbfe0d0933aa21"},{"url":"https://github.com/slackhq/nebula"}],"tags":["osv","go"],"epss":0.00171,"epssPercentile":0.05685,"ingestedAt":"2026-09-12T03:13:01.758Z","slug":"CVE-2026-25793","body":"## Overview\n\n### Impact\n\nWhen using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint.\n\nIn order for this to affect a user or network, all of the following must be true:\n* `CURVE_P256` certificates are being used\n* There are one or more entries on the blocklist\n* The certificates for those entries are signed by a trusted CA and not expired\n* An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries\n\n### Patches\n\nSee attached\n\n### Workarounds\n\nIf full copies of each certificate on the existing blocklist are available, it is possible to compute their opposite-chirality signature, and then the appropriate second fingerprint to list in the blocklist.\n\nRotating out all CAs that have signed hosts on the blocklist will also prevent exploitation of this vulnerability.\n\n## Affected packages\n\n- `github.com/slackhq/nebula >= 1.7.0, < 1.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/slackhq/nebula 1.10.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}