What this actually is.
Technical background, root cause, and affected surface.
The NetBird relay server accepted the deprecated Hello handshake message pre-authentication and passed attacker-supplied bytes to encoding/gob (unmarshalToken) before verifying the HMAC signature. This exposed the gob decoder, which has had DoS vulnerabilities such as CVE-2024-34156, to anonymous network clients.
- Vendor
- NetBird
- Product
- NetBird v0.74.3
- Severity
- Medium
- CVSS Score
- 6.3
- Status
- Fixed
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- CWE
- CWE-502: Deserialization of Untrusted Data
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Send a Hello handshake message to a relay server older than v0.75.0; the payload reaches gob.Decode without credentials (Go PoC TestH16_GobDecoderSurface). Over the wire input is bounded to 212 bytes by MaxHandshakeSize.
The bug, and the fix.
shared/relay/auth/hmac/token.go:21: gob.NewDecoder(bytes.NewReader(raw)).Decode(&t) // runs before signature check in validator.go:22-33; relay/server/handshake.go routes MsgTypeHello to handleHelloMsg pre-auth
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Unauthenticated reachability of the gob decoder on the relay server; denial of service if the server is built with a Go toolchain affected by a gob DoS CVE. No confidentiality or integrity impact (vendor reassessed from High 7.7 to Medium 6.3).
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade the relay server to NetBird v0.75.0 or later (PR #6783). The Hello message type and all gob-based token decoding were removed; authentication runs only via the Auth message using a fixed-layout parser with explicit length checks.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to NetBird via GitHub Security Advisory
Vendor accepted
Fix released in v0.75.0 (PR #6783)
Advisory published, reassessed to Medium 6.3 (GHSA-v5w2-pqxj-6r94)
CVE-2026-105430 assigned
Disclosed 0 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.