CVE-2025-62820: Slack Nebula may accept arbitrary source IP addresses

The vulnerability lies in a custom CIDR tree implementation (cidr.Tree4 and cidr.Tree6) that was used for IP-based access control in various parts of Nebula, including the firewall and allow lists. This custom implementation had flaws that could be exploited to bypass access control checks, allowing packets from unauthorized source IP addresses to be processed as if they were legitimate. The provided patch replaces this bespoke, vulnerable code with a standard, well-tested library for CIDR matching (github.com/gaissmai/bart) and migrates from net.IP to the more modern and safer net/netip package. The vulnerable functions identified are the key access control decision points that relied on the flawed CIDR tree implementation. By exploiting the flaw in the underlying CIDR matching, an attacker could circumvent these checks.