CVE-2026-25882

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25882", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-06T21:08:39.129Z", "datePublished": "2026-02-24T21:05:28.211Z", "dateUpdated": "2026-02-24T21:39:51.170Z"}, "containers": {"cna": {"title": "Fiber has a Denial of Service Vulnerability via Route Parameter Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-129", "lang": "en", "description": "CWE-129: Improper Validation of Array Index", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3"}, {"name": "https://github.com/gofiber/fiber/pull/3962", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/pull/3962"}, {"name": "https://github.com/gofiber/fiber/blob/main/path.go#L514", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/blob/main/path.go#L514"}, {"name": "https://github.com/gofiber/fiber/blob/v2/path.go#L516", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/blob/v2/path.go#L516"}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"version": ">= 2.0.0, < 2.52.12", "status": "affected"}, {"version": ">= 3.0.0, < 3.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:09:57.502Z"}, "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch."}], "source": {"advisory": "GHSA-mrq8-rjmw-wpq3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T21:39:39.261259Z", "id": "CVE-2026-25882", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:39:51.170Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25882", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T21:39:39.261259Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:39:44.016Z"}}], "cna": {"title": "Fiber has a Denial of Service Vulnerability via Route Parameter Overflow", "source": {"advisory": "GHSA-mrq8-rjmw-wpq3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.52.12"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.0"}]}], "references": [{"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3", "name": "https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gofiber/fiber/pull/3962", "name": "https://github.com/gofiber/fiber/pull/3962", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gofiber/fiber/blob/main/path.go#L514", "name": "https://github.com/gofiber/fiber/blob/main/path.go#L514", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gofiber/fiber/blob/v2/path.go#L516", "name": "https://github.com/gofiber/fiber/blob/v2/path.go#L516", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-129", "description": "CWE-129: Improper Validation of Array Index"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:09:57.502Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25882", "state": "PUBLISHED", "dateUpdated": "2026-02-24T21:39:51.170Z", "dateReserved": "2026-02-06T21:08:39.129Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T21:05:28.211Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fiber", "vendor": "gofiber", "versions": [{"status": "affected", "version": ">= 2.0.0, < 2.52.12"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*", "matchCriteriaId": "A15FB157-FB93-48D8-834A-6083BC452C3A", "versionEndExcluding": "2.52.12", "versionStartIncluding": "2.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*", "matchCriteriaId": "0BE31D7D-3EA7-4474-930A-0FD4C237989C", "versionEndExcluding": "3.1.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch."}, {"lang": "es", "value": "Fiber es un framework web inspirado en Express escrito en Go. Existe una vulnerabilidad de denegaci\u00f3n de servicio en Fiber v2 y v3 que permite a atacantes remotos bloquear la aplicaci\u00f3n enviando solicitudes a rutas con m\u00e1s de 30 par\u00e1metros. La vulnerabilidad resulta de la falta de validaci\u00f3n durante el registro de rutas combinada con una escritura de array sin l\u00edmites durante la coincidencia de solicitudes. La versi\u00f3n 2.52.12 corrige el problema en la rama v2 y la 3.1.0 corrige el problema en la rama v3."}], "id": "CVE-2026-25882", "lastModified": "2026-06-17T10:25:22.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25882", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T21:39:39.261259Z", "version": "2.0.3"}}]}, "published": "2026-02-24T21:16:29.640", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/gofiber/fiber/blob/main/path.go#L514"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/gofiber/fiber/blob/v2/path.go#L516"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/gofiber/fiber/pull/3962"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-mrq8-rjmw-wpq3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.52.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fiber", "source": "cna", "vendor": "gofiber"}, "product": "fiber", "vendor": "gofiber"}], "analysis": {"en": {"generated_at": "2026-04-18T17:43:56.575317+00:00", "value": {"mitigation_remediation": ["Upgrade the Fiber framework to v2.52.12 or later if you are using the v2 branch.", "Upgrade to v3.1.0 or later if you are using the v3 branch.", "If an upgrade is not immediately possible, add server\u2011side logic that rejects routes with more than 30 parameters or otherwise limits the number of parameters parsed for any request."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Fiber v2 and v3 prior to the release of patches. Any project using Fiber v2 older than 2.52.12 or Fiber v3 older than 3.1.0 is susceptible. The runtime environment is typically web servers running the Go runtime that host the Fiber application, regardless of operating system.", "description_and_impact": "Fiber is an Express\u2011inspired web framework written in Go. A missing validation during route registration combined with an unbounded array write during request matching creates a route parameter overflow. When a remote attacker sends an HTTP request that includes more than 30 parameters, the framework crashes, resulting in a denial of service. The flaw is categorized as CWE\u2011129, and based on the description, it is inferred that the vulnerability does not require privileged access, so it can be triggered simply by sending a crafted request to any public\u2011facing Fiber instance.", "risk_and_exploitability": "The CVSS score is 5.5, indicating moderate severity. The EPSS score of <1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, because the overflow can be triggered remotely without authentication, the operational risk remains for publicly accessible services. An attacker may simply request a URL with an excessive number of route parameters to crash the application."}}}}, "created": "2026-02-25T11:35:31.491262+00:00", "updated": "2026-04-18T17:45:06.066313+00:00", "vendors": ["gofiber", "gofiber$PRODUCT$fiber"]}