Summary
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
internal/api/pop/nonce.go:25,40,86 + internal/api/server.go:38, the signed-poll nonce cache is an in-process LRU sized at 65,536 entries. internal/api/updates.go:31 sets pollClockSkew = 5 * time.Minute as the replay window.
Affected
All released versions through v0.3.0 that have shipped the ADR 0004 signed-poll path. (If this is gated behind a feature flag, on a side branch, or not yet on a release tag, please flag, this advisory may not apply to the released artifact yet.)
Threat model
A captured signed-poll request can be replayed:
- After any process restart, the in-memory LRU is wiped, so the original nonce becomes "unseen" again. Replay succeeds if the original timestamp is still within the 5-minute skew.
- After forced eviction, an attacker with control of any single host can flood >65,536 nonces under their own host_id, driving the global LRU to evict the victim's recorded nonce. Replay then succeeds.
Impact is bounded: a replayed poll fetches the /api/v1/agent/updates body. That body can include a freshly-minted enrollment token if a rekey is pending (updates.go:249-260), at which point the attacker holds a single-use token they can redeem under their own keypair.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Two options, either acceptable:
- Persist nonces in SQLite keyed by
(host_id, nonce)withON CONFLICT DO NOTHING, retained for the timestamp-skew window. Adds one transactional INSERT per poll; bounded by the skew window (~5 min worth of rows server-wide). - Per-host cap on the LRU instead of a global 65k cap, so one host cannot evict another's records. Combined with shorter skew (≤30s) to bound the post-restart replay window.
Option 1 is more robust; option 2 is lower-implementation-effort.
Frequently Asked Questions
- What is GHSA-V2JF-442R-6MJH? GHSA-V2JF-442R-6MJH is a low-severity security vulnerability in github.com/juev/nebula-mesh (go), affecting versions <= 0.3.3. It is fixed in 0.3.4.
- Which versions of github.com/juev/nebula-mesh are affected by GHSA-V2JF-442R-6MJH? github.com/juev/nebula-mesh (go) versions <= 0.3.3 is affected.
- Is there a fix for GHSA-V2JF-442R-6MJH? Yes. GHSA-V2JF-442R-6MJH is fixed in 0.3.4. Upgrade to this version or later.
- Is GHSA-V2JF-442R-6MJH exploitable, and should I be worried? Whether GHSA-V2JF-442R-6MJH is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-V2JF-442R-6MJH is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-V2JF-442R-6MJH? Upgrade
github.com/juev/nebula-meshto 0.3.4 or later.