Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gofiber | fiber | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-mrq8-rjmw-wpq3 | Fiber has a Denial of Service Vulnerability via Route Parameter Overflow |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Tue, 24 Feb 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 24 Feb 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.0.1 patches the issue in the v3 branch. | Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch. |
Tue, 24 Feb 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.0.1 patches the issue in the v3 branch. | |
| Title | Fiber has a Denial of Service Vulnerability via Route Parameter Overflow | |
| Weaknesses | CWE-129 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-02-24T21:39:51.170Z
Reserved: 2026-02-06T21:08:39.129Z
Link: CVE-2026-25882
Vulnrichment
Updated: 2026-02-24T21:39:44.016Z
NVD
Status : Awaiting Analysis
Published: 2026-02-24T21:16:29.640
Modified: 2026-02-24T22:16:31.310
Link: CVE-2026-25882
Redhat
No data.
OpenCVE Enrichment
No data.