GO-2026-5989
Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh
Quick fix
GO-2026-5989 — github.com/forgekeep/nebula-mesh: upgrade to the fixed version with the command below.
go get github.com/forgekeep/nebula-mesh@v0.5.0Details
When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map.
An unauthenticated remote client can grow the state storage, bounded by request throughput rather than by configured auth rate limits, potentially leading to a denial of service.
Are you affected?
Enter the version of the package you're using.
Affected packages
0.4.0 Fixed in: 0.5.0 go get github.com/forgekeep/nebula-mesh@v0.5.0 0.2.0 No fixed version published yet for github.com/juev/nebula-mesh (go modules). Pin to a known-safe version or switch to an alternative.