CVE-2026-25882

Katalog CVE

CVSS 7.5 · High EPSS 0,83%

Kerentanan Improper Validation of Array Index pada gofiber fiber. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.

Rincian

Terbit di NVD

24 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-129: Improper Validation of Array Index

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3 exploit · advisory vendor
• https://github.com/gofiber/fiber/pull/3962 issue tracking · patch
• https://github.com/gofiber/fiber/blob/main/path.go#L514 product
• https://github.com/gofiber/fiber/blob/v2/path.go#L516 product