CVE-2026-25899 Details
Description
Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory via unvalidated msgpack deserialization. No authentication is required. Every GoFiber v3 endpoint is affected regardless of whether the application uses flash messages. Version 3.1.0 fixes the issue.
A denial-of-service vulnerability has been identified in the GoFiber web framework, specifically in version 3.0.0 and prior. The issue arises from the handling of the 'fiber_flash' cookie, which can be exploited to cause an unbounded memory allocation on the server. When a crafted 10-character cookie value is received, it triggers a deserialization process that can attempt to allocate up to 85GB of memory, leading to a server crash. This vulnerability affects all GoFiber v3 endpoints, regardless of whether flash messages are used, and does not require authentication.
Users can upgrade to GoFiber version 3.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gofiber/fiber/releases/tag/v3.1.0 | [email protected] | Release Notes |
| https://github.com/gofiber/fiber/security/advisories/GHSA-2mr3-m5q5-wgp6 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gofiber fiber | >= 3.0.0, < 3.1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |