A memory handling flaw in nebula‑mesh allows the decrypted CA private key to remain in a process’s heap after signing is complete. The key material is kept in a slice that is never zeroised, so it can be read from memory for minutes to hours until Go’s garbage collector eventually deletes it. This vulnerability is a classic example of CWE-244, where sensitive data persists longer than needed, enabling potential leakage if an attacker can read the process memory.

The issue affects the Juev nebula‑mesh control plane; all releases prior to version 0.3.7 are vulnerable. An update to v0.3.7 implements an explicit zeroisation of the private key slice after use, effectively eliminating the persistence problem.

The CVSS score of 6.9 indicates moderate risk, and the EPSS score of less than 1 % shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to gain local or remote code‑execution ability within the nebula‑mesh process in order to read the heap, so the attack vector is inferred to be local privileged compromise. Updating to the patched version removes the risk; otherwise, the exposed memory remains a risk for privileged or compromised processes.