VULNERABILITY INTELLIGENCE

CVE-2026-25882

CVSS score7.5 HIGH

EPSS probability0.67%

CISA KEVNot currently listed

Published2026-02-24

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.

Weakness classification

security-advisories@github.com: CWE-129

Primary references

security-advisories@github.com — Product
security-advisories@github.com — Product
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Exploit, Vendor Advisory