https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 05:49:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-48025 <p><strong>Affected:</strong> juev nebula-mesh</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package&#39;s contract (internal/keystore/keystore.go doc: &#34;Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed&#34;) is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go&#39;s GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.</p> <p><strong>Affected:</strong> juev nebula-mesh</p> <p>nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package&#39;s contract (internal/keystore/keystore.go doc: &#34;Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed&#34;) is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go&#39;s GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.</p> https://vulnerability.circl.lu/vuln/cve-2026-48025