CVE-2026-25899

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25899", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-06T21:08:39.131Z", "datePublished": "2026-02-24T21:11:17.804Z", "dateUpdated": "2026-02-24T21:37:33.970Z"}, "containers": {"cna": {"title": "Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation", "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6"}, {"name": "https://github.com/gofiber/fiber/releases/tag/v3.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gofiber/fiber/releases/tag/v3.1.0"}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"version": ">= 3.0.0, < 3.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:11:17.804Z"}, "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue."}], "source": {"advisory": "GHSA-2mr3-m5q5-wgp6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T21:37:21.605800Z", "id": "CVE-2026-25899", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:37:33.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T21:37:21.605800Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:37:28.560Z"}}], "cna": {"title": "Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocation", "source": {"advisory": "GHSA-2mr3-m5q5-wgp6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gofiber", "product": "fiber", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.1.0"}]}], "references": [{"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6", "name": "https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gofiber/fiber/releases/tag/v3.1.0", "name": "https://github.com/gofiber/fiber/releases/tag/v3.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T21:11:17.804Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25899", "state": "PUBLISHED", "dateUpdated": "2026-02-24T21:37:33.970Z", "dateReserved": "2026-02-06T21:08:39.131Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T21:11:17.804Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fiber", "vendor": "gofiber", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*", "matchCriteriaId": "0BE31D7D-3EA7-4474-930A-0FD4C237989C", "versionEndExcluding": "3.1.0", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue."}, {"lang": "es", "value": "Fiber es un framework web inspirado en Express escrito en Go. En versiones de la rama v3 anteriores a la 3.1.0, el uso de la 'cookie' fiber_flash puede forzar una asignaci\u00f3n ilimitada en cualquier servidor. Un valor de cookie manipulado de 10 caracteres desencadena un intento de asignar hasta 85 GB de memoria a trav\u00e9s de una deserializaci\u00f3n msgpack no validada. No se requiere autenticaci\u00f3n. Cada endpoint de GoFiber v3 se ve afectado independientemente de si la aplicaci\u00f3n utiliza mensajes flash. La versi\u00f3n 3.1.0 corrige el problema."}], "id": "CVE-2026-25899", "lastModified": "2026-06-17T10:25:24.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25899", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T21:37:21.605800Z", "version": "2.0.3"}}]}, "published": "2026-02-24T22:16:31.613", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/gofiber/fiber/releases/tag/v3.1.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fiber", "source": "cna", "vendor": "gofiber"}, "product": "fiber", "vendor": "gofiber"}], "analysis": {"en": {"generated_at": "2026-04-17T15:37:57.019005+00:00", "value": {"mitigation_remediation": ["Upgrade GoFiber to version 3.1.0 or later, which removes the unbounded allocation bug.", "If an upgrade cannot be performed immediately, remove or disable the use of flash messages in the application or implement input validation that rejects flash_cookie values longer than the safe threshold.", "Apply application\u2011level resource limits or CPU/memory quotas to the GoFiber process, and monitor for abnormal memory consumption that could indicate an attempted denial\u2011of\u2011service attack."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "This flaw affects all ships of GoFiber v3 released prior to version 3.1.0. The framework, written in Go and inspired by Express, is distributed under the gofiber:fiber product line. The issue is present in every endpoint because flash messages are processed globally, regardless of whether the application uses them.", "description_and_impact": "The vulnerability resides in the handling of the fiber_flash cookie within the GoFiber web framework. A specially crafted 10\u2011character cookie value triggers unvalidated msgpack deserialization, causing the framework to attempt allocating up to 85\u202fGB of memory. Successful exploitation forces the server to consume excessive resources, leading to degraded performance or a crash, thereby denying legitimate users access. The flaw is reflected in the CVE\u2019s CWE identifiers for uncontrolled resource consumption and buffer overflow. No authentication is required, meaning any client can trigger the denial.", "risk_and_exploitability": "The CVSS base score of 7.5 indicates a high severity, while the EPSS score of less than 1\u202f% signals that exploitation is currently rare but not impossible. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no publicly documented exploits exist at this time. Likely exploitation would involve sending a malicious request with the crafted flash cookie over the network; since no credentials are needed, the attacker only requires network access to the target web application."}}}}, "created": "2026-02-25T11:35:29.826066+00:00", "updated": "2026-04-17T15:45:15.897825+00:00", "vendors": ["gofiber", "gofiber$PRODUCT$fiber"]}