{"id":"EUVD-2025-16352","enisaUuid":"828a3d58-ba5a-3283-9698-03809ca8b564","description":"Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser`  functionality. Version 2.52.7 fixes the issue.","datePublished":"May 22, 2025, 5:25:18 PM","dateUpdated":"May 22, 2025, 5:59:02 PM","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm\nhttps://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d\n","aliases":"CVE-2025-48075\nGHSA-hg3g-gphw-5hhm\n","assigner":"GitHub_M","epss":0.53,"enisaIdProduct":[{"id":"05fbe251-d684-3e8f-bc8c-bba738e3c4c6","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"2.52.6, \u003c 2.52.7"}],"enisaIdVendor":[{"id":"4c413a64-6aea-34a2-aa8d-59caee3cba57","vendor":{"name":"gofiber"}}],"enisaIdVulnerability":[{"id":"358cdd06-213f-3cd3-9dda-9d6a79850859","vulnerability":{"id":"CVE-2025-48075","description":"Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser`  functionality. Version 2.52.7 fixes the issue.","datePublished":"May 22, 2025, 5:25:18 PM","dateUpdated":"May 22, 2025, 5:59:02 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P","references":"https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm\nhttps://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d\n","enisa_id":"EUVD-2025-16352\n","assigner":"GitHub_M","epss":0.53,"dataProcessed":"Nov 15, 2026, 5:15:56 AM","vulnerabilityProduct":[{"id":"80b3f94f-67f0-3882-b68d-cddee6206836","product":{"name":"fiber","vendor":{"name":"gofiber"}},"product_version":"2.52.6, \u003c 2.52.7"}],"vulnerabilityVendor":[{"id":"f413a034-c632-3cff-b778-479b8b86c6c4","vendor":{"name":"gofiber"}}]}},{"id":"9ad54094-06d6-3f13-9f62-35a9ae93c8f0","vulnerability":{"id":"GHSA-hg3g-gphw-5hhm","description":"Fiber panics when fiber.Ctx.BodyParser parses invalid range index","datePublished":"May 22, 2025, 8:08:31 PM","dateUpdated":"May 28, 2025, 7:46:57 PM","baseScore":0.0,"references":"https://github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhm\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-48075\nhttps://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d\nhttps://github.com/gofiber/fiber\nhttps://pkg.go.dev/vuln/GO-2025-3706\n","enisa_id":"EUVD-2025-16352\n","aliases":"GHSA-hg3g-gphw-5hhm\nCVE-2025-48075\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:42:45 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"da7a7e0a-0878-30f1-8f48-645422fcb79e","advisory":{"id":"openSUSE-SU-2025:15179-1","description":"govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media","datePublished":"May 30, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:34:36 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15179-1.json\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NUT27N46T3RCYUKKZDD2PQ3C7X7OURLR/\nhttps://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NUT27N46T3RCYUKKZDD2PQ3C7X7OURLR/\nhttps://www.suse.com/security/cve/CVE-2025-4123/\nhttps://www.suse.com/security/cve/CVE-2025-48075/\nhttps://www.suse.com/security/cve/CVE-2025-48371/\nhttps://www.suse.com/security/cve/CVE-2025-48374/\n","aliases":"CVE-2025-4123\nCVE-2025-48075\nCVE-2025-48371\nCVE-2025-48374\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1a508c0d-ac28-3b1c-9c70-eab534de6a3e","product":{"name":"govulncheck-vulndb-0.0.20250527T204717-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2ccd581c-7404-36dd-86e7-c1aff6c9d38f","product":{"name":"govulncheck-vulndb-0.0.20250527T204717-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"45c1d8b9-3c7b-3276-915e-208d7feae078","product":{"name":"govulncheck-vulndb-0.0.20250527T204717-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"533b8936-dbb3-3bd9-b0b3-1f3f4fda8d69","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"57899b80-fe18-3456-8d7f-5d1b612b82a0","product":{"name":"govulncheck-vulndb-0:0.0.20250527T204717-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a3af3b53-f293-39bd-803a-1a31eb06e835","product":{"name":"govulncheck-vulndb-0:0.0.20250527T204717-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d7f3f38a-405e-3675-80d5-5296cbcd01f0","product":{"name":"govulncheck-vulndb-0.0.20250527T204717-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"dd818d4b-cbc0-395a-9ca4-4b7c9889e0a1","product":{"name":"govulncheck-vulndb-0:0.0.20250527T204717-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fd469613-dc08-3f19-a1af-d360be3315ba","product":{"name":"govulncheck-vulndb-0:0.0.20250527T204717-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}