CVE-2026-119285

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119285", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-29T18:50:28.065Z", "datePublished": "2026-10-29T21:36:02.199Z", "dateUpdated": "2026-11-04T01:55:09.920Z"}, "containers": {"cna": {"title": "Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-942", "lang": "en", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"}, {"name": "https://github.com/gofiber/fiber/pull/2915", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/pull/2915"}, {"name": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"}, {"name": "https://github.com/gofiber/fiber/releases/tag/v2.52.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/releases/tag/v2.52.3"}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"version": ">= 2.52.1, < 2.52.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:36:02.199Z"}, "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3."}], "source": {"advisory": "GHSA-g5jq-qmqr-qrwf", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T01:54:49.126662Z", "id": "CVE-2026-119285", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:55:09.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119285", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T01:54:49.126662Z"}}}], "references": [{"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T01:55:04.788Z"}}], "cna": {"title": "Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads", "source": {"advisory": "GHSA-g5jq-qmqr-qrwf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"status": "affected", "version": ">= 2.52.1, < 2.52.3"}]}], "references": [{"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf", "name": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gofiber/fiber/pull/2915", "name": "https://github.com/gofiber/fiber/pull/2915", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b", "name": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gofiber/fiber/releases/tag/v2.52.3", "name": "https://github.com/gofiber/fiber/releases/tag/v2.52.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T21:36:02.199Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119285", "state": "PUBLISHED", "dateUpdated": "2026-11-04T01:55:09.920Z", "dateReserved": "2026-10-29T18:50:28.065Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T21:36:02.199Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fiber", "vendor": "gofiber", "versions": [{"status": "affected", "version": ">= 2.52.1, < 2.52.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3."}], "id": "CVE-2026-119285", "lastModified": "2026-11-04T02:17:19.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119285", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T01:54:49.126662Z", "version": "2.0.3"}}]}, "published": "2026-10-29T22:17:01.367", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b"}, {"source": "security-advisories@github.com", "url": "https://github.com/gofiber/fiber/pull/2915"}, {"source": "security-advisories@github.com", "url": "https://github.com/gofiber/fiber/releases/tag/v2.52.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-942"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/gofiber/fiber: Fiber: Information disclosure via improper CORS origin validation", "id": "2563712", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563712"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-346", "details": ["Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker's page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.", "A flaw was found in Fiber. When configured with wildcard subdomains and credentials enabled, the Cross-Origin Resource Sharing (CORS) middleware improperly validates domain origins by checking only the host suffix without enforcing a proper domain boundary. A remote attacker can exploit this issue by enticing an authenticated user to visit an attacker-controlled website whose domain shares the suffix of an allowed site. Successful exploitation results in information disclosure, allowing the attacker to access authenticated responses and sensitive data from the user's session."], "name": "CVE-2026-119285", "public_date": "2026-10-29T21:36:02Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119285\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119285\nhttps://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b\nhttps://github.com/gofiber/fiber/pull/2915\nhttps://github.com/gofiber/fiber/releases/tag/v2.52.3\nhttps://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf"], "statement": "This vulnerability is rated as having Moderate severity because successful exploitation requires non-default application settings and user interaction, limiting the likelihood of unauthorized credentialed data access. The flaw only manifests when web services enable cross-origin credentials and rely on wildcard expressions for permitted domains, allowing third-party hosts with matching name endings to bypass access controls. Although an adversary could read private session responses if a victim visits an external landing site, normal deployments that specify exact domain origins or omit credential exchange remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.52.1,2.52.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fiber", "source": "cna", "vendor": "gofiber"}, "product": "fiber", "vendor": "gofiber"}], "created": "2026-10-29T22:15:03.617023+00:00", "updated": "2026-10-29T22:45:03.508457+00:00", "vendors": ["gofiber", "gofiber$PRODUCT$fiber"]}