Threats tagged 'ghsa-8h84-fhqq-q58v'

A vulnerability in nebula-mesh (up to version 0.3.6) causes decrypted CA private keys to remain in process memory after use. The CA private key is not zeroized after signing operations, allowing it to persist in the heap until garbage collection occurs. This exposure risks memory-read attacks such as core dumps, ptrace, or container snapshots. The issue is fixed in version 0.3.7.