CVE-2025-66565
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.47%
- CWE
- CWE-252, CWE-331, CWE-338
- Published
- 2025-12-09
- Last modified
- 2026-03-13
Affected products
- gofiber utils
- gofiber utils
Weakness type
Related vulnerabilities
- CVE-2026-86749 — snipe-it before 8.7.0 Data Loss via Failed Image Write
- CVE-2026-86739 — Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
- CVE-2026-86141 — xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a...
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
- CVE-2026-14957 — FIPS mode assertion failure via malicious CERT payload
- CVE-2026-78699 — rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-79772 — Nokogiri before 1.19.1 Unchecked Return Value canonicalize