This release patches 2 CVEs for security teams tracking exposure across their dependency inventory.
Published 3mo
VPN & Tunnels
2 patched CVEs
This release patches 2 known CVEs
GHSA-69x3-g4r3-p962
GO-2026-4458
2
CVEs patched
Summary
AI summarySecurity fix for P256 curve blocklist bypass vulnerability allowing invalid certificates to be accepted. Both signature representations now validated. New certificates clamped to low-s form. Improved tun device naming error reporting.
Breaking Changes
- P256 signature validation enforcement
Security Fixes
- GHSA-69x3-g4r3-p962 (P256 blocklist bypass)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Nebula
A scalable overlay networking tool with a focus on performance, simplicity and security
Beta — feedback welcome: [email protected]