AIKIDO-2025-10711

TL;DR

Affected versions of this package are vulnerable to IP-spoofing due to improper CIDR construction in hostmap.go. When a node’s certificate contains multiple IPs or a routed subnet, the code incorrectly expands the allowed addresses (using Mask.Size() instead of the address bit length), letting a compromised or rogue node send packets with any source IP from the Nebula network that peers will accept. An attacker who controls such a node can impersonate other hosts, inject arbitrary UDP traffic, or disrupt connections (for example by sending forged TCP RSTs).