CRITICAL🇵🇱 Wersja polska

CVE-2025-66565

CVSS 9.3v4.0pub. 2025-12-09upd. 2025-12-11

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

When the crypto/rand.Read() call fails, both UUID generation functions do not signal this error to the calling code (CWE-252 — unchecked return value), but silently fall back to creating predictable UUID values. The source of the fallback randomness is a weak or deterministic generator (CWE-338 — use of cryptographically weak PRNG), and insufficient entropy (CWE-331) leads in extreme cases to returning a zero UUID '00000000-0000-0000-0000-000000000000'. The issue occurs through two separate failure paths, whose common source is the failure of crypto/rand.Read().

Impact

An attacker can predict or reproducibly recreate generated UUIDs, which enables bypassing authentication, authorization, or session protection mechanisms in all Fiber applications using these functions for security operations. This results in high loss of application data confidentiality and integrity.

Mitigation & patch

Update the Gofiber Utils library to version 2.0.0-rc.4, where the issue has been fixed. Patch details are available in the project repository under the indicated commit and in security advisory GHSA-m98w-cqp3-qcqr.

Who is affected

Gofiber Utils in versions 2.0.0-rc.3 and earlier

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X