Skip to main content

Fiber CVE-2025-54801

HIGH
Memory Allocation with Excessive Size Value (CWE-789)
2025-08-06 security-advisories@github.com
Denial Of Service Fiber Suse
8.7
CVSS 4.0 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:05 vuln.today
Patch released
Mar 28, 2026 - 19:05 nvd
Patch available
CVE Published
Aug 06, 2025 - 00:15 nvd
HIGH 8.7

DescriptionGitHub Advisory

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.

AnalysisAI

Fiber is an Express inspired web framework written in Go. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-789. Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9. Affected products include: Gofiber Fiber. Version information: version 2.52.9..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Fiber

View all
CVE-2024-25124 CRITICAL POC
9.8 Feb 21

Fiber is a web framework written in go. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2026-25899 HIGH POC
7.5 Feb 24

Unbounded memory allocation in Fiber v3 (prior to 3.1.0) allows unauthenticated remote attackers to trigger denial of se
CVE-2026-25882 HIGH POC
7.5 Feb 24

Fiber web framework versions 2 and 3 are vulnerable to denial of service attacks when processing requests to routes cont
CVE-2026-25891 HIGH POC
7.5 Feb 24

Fiber web framework versions 3.0.0 and earlier on Windows contain a path traversal vulnerability that allows remote atta
CVE-2024-38513 CRITICAL
9.8 Jul 01

Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a sessio
CVE-2025-66630 CRITICAL
9.4 Feb 09

Go Fiber web framework before 2.52.11 has a weak PRNG vulnerability (on Go < 1.24) that makes session tokens predictable
CVE-2023-45141 HIGH
8.8 Oct 16

Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
CVE-2023-45128 HIGH
8.8 Oct 16

Fiber is an express inspired web framework written in Go. Rated high severity (CVSS 8.8), this vulnerability is remotely
CVE-2020-15111 MEDIUM
5.4 Jul 20

In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is
CVE-2023-41338 MEDIUM
5.3 Sep 08

Fiber is an Express inspired web framework built in the go language. Rated medium severity (CVSS 5.3), this vulnerabilit
CVE-2025-48075 HIGH POC
7.7 May 22

Fiber is an Express-inspired web framework written in Go. Rated high severity (CVSS 7.7), this vulnerability is remotely

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-59204 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7
CVE-2021-47944 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/base-os-container:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-EC2 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2025-54801 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy