Executive brief
A vulnerability in the nebula-mesh authentication system allows unauthenticated users to exhaust server memory. By repeatedly accessing the OIDC login page, an attacker can force the server to store large amounts of temporary data that does not expire quickly enough. This can lead to service slowdowns or crashes, impacting the availability of the mesh network management interface.
Technical details
An uncontrolled resource consumption vulnerability exists in nebula-mesh when OIDC is enabled. The 'GET /ui/oidc/login' endpoint is registered outside of the standard rate-limiting middleware and does not require authentication. Each request to this endpoint generates a unique OIDC state token stored in an in-memory map with a 10-minute TTL. Because there is no cap on the number of live states or rate limiting on the allocation path, a remote attacker can flood the endpoint to cause linear memory growth. The issue is fixed in version 0.5.0 by applying rate limits and state caps.
Affected products
- forgekeep nebula-mesh >= 0.2.0, < 0.5.0
Timeline
- 2026-06-13: disclosed: Initial report by sondt99
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Version 0.5.0 released