GHSA-69x3-g4r3-p962

Source

https://github.com/advisories/GHSA-69x3-g4r3-p962

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-69x3-g4r3-p962/GHSA-69x3-g4r3-p962.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-69x3-g4r3-p962

Aliases

Downstream

CGA (16)

MINI (1)

MINI-8qgr-99vw-p8xr

Published

2026-02-06T20:05:35Z

Modified

2026-09-10T03:49:48Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Blocklist Bypass possible via ECDSA Signature Malleability

Details

Impact

When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint.

In order for this to affect a user or network, all of the following must be true:

CURVE_P256 certificates are being used
There are one or more entries on the blocklist
The certificates for those entries are signed by a trusted CA and not expired
An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries

Patches

See attached

Workarounds

If full copies of each certificate on the existing blocklist are available, it is possible to compute their opposite-chirality signature, and then the appropriate second fingerprint to list in the blocklist.

Rotating out all CAs that have signed hosts on the blocklist will also prevent exploitation of this vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-06T20:05:35Z",
    "nvd_published_at":  "2026-02-06T23:15:54Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/slackhq/nebula

Package

Name: github.com/slackhq/nebula; View open source insights on deps.dev
Purl: pkg:golang/github.com/slackhq/nebula

Affected ranges

Type: SEMVER
Events: Introduced

1.7.0

Fixed

1.10.3

Database specific

last_known_affected_version_range

"<= 1.10.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-69x3-g4r3-p962/GHSA-69x3-g4r3-p962.json"