CVE-2025-54801

HIGH EPSS 24.9%
Published Aug 6, 202510mo ago · Modified Jun 17, 20262w ago
8.7 CVSS 4.0
High
Find Similar
Published Aug 6, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.

CVSS Details

Base Score
8.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
24.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-789

Affected Products 1

VendorProductVersionRange
gofiberfiber* <2.52.9

References 2

  • github.com https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
    Patch
  • github.com https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7
    Vendor Advisory

Remediation

  • github.com https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d
    Patch