CVE-2025-48075: Fiber panics when fiber.Ctx.BodyParser parses invalid range index
Vulnerability summary
CVE-2025-48075 is a high (CVSS 7.7) Improper Validation of Array Index vulnerability in gofiber fiber. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 22-05-2025PublishedVulnerability first disclosed.
- 22-05-2025Last modifiedVulnerability information updated.
Description
Fiber is an Express-inspired web framework written in Go. Starting in version 2.52.6 and prior to version 2.52.7, `fiber.Ctx.BodyParser` can map flat data to nested slices using `key[idx]value` syntax, but when idx is negative, it causes a panic instead of returning an error stating it cannot process the data. Since this data is user-provided, this could lead to denial of service for anyone relying on this `fiber.Ctx.BodyParser` functionality. Version 2.52.7 fixes the issue.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:PDiffers
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 0.50% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFiber
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- gatus< 5.17.0-r3
- gatus-compat< 5.17.0-r3
Wolfi2 products
- gatus< 5.17.0-r3
- gatus-compat< 5.17.0-r3
Github.com/gofiber1 product
- fiberAll versions (No fix recorded)
Github.com/gofiber/fiber1 product
- v2≥ 2.52.6, < 2.52.7
Gofiber1 product
- fiber≥ 2.52.6, < 2.52.7 | ≥ 2.0.0, < 2.52.7
5 vendors · 7 products
References
6 links- github.com/gofiber/fiber/security/advisories/GHSA-hg3g-gphw-5hhmX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/gofiber/fiberPACKAGE