CVE-2025-66630

Katalog CVE

CVSS 9.4 · Critical EPSS 0,53%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada gofiber fiber. Skor CVSS 3.1 9.4 (Critical) menurut NVD.

Deskripsi (NVD)

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.4 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gofiber/fiber/security/advisories/GHSA-68rr-p4fp-j59v advisory vendor
• https://github.com/gofiber/fiber/commit/eb874b6f6c5896b968d9b0ab2b56ac7052cb0ee1 patch
• https://github.com/gofiber/fiber/releases/tag/v2.52.11 product · release notes