{"schema_version":"1.9.0","id":"CVE-2025-54801","published":"2025-08-05T23:33:28.221Z","modified":"2026-08-12T03:51:10.194392350Z","aliases":["GHSA-qx2q-88mx-vhg7","GO-2025-3845"],"related":["CGA-vp7x-3q95-x4wq","SUSE-SU-2025:02912-1","openSUSE-SU-2025:15434-1"],"summary":"Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decoder","details":"Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gofiber/fiber","events":[{"introduced":"0"},{"fixed":"1197a22735820680ccfa241914b925f3820fcfd4"},{"fixed":"e115c08b8f059a4a031b492aa9eef0712411853d"}],"database_specific":{"cpe":"cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.52.9"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.52.8","v2.52.7","v2.52.6","v2.52.5","v2.52.4","v2.52.3","v2.52.2","v2.52.1","v2.52.0","v2.51.0","v2.50.0","v2.49.2","v2.49.1","v2.49.0","v2.48.0","v2.47.0","v2.46.0","v2.45.0","v2.44.0","v2.43.0","v2.42.0","v2.41.0","v2.40.1","v2.40.0","v2.39.0","v2.38.1","v2.38.0","v2.37.1","v2.37.0","v2.37.0-rc.1","v2.36.0","v2.35.0","v2.34.1","v2.34.0","v2.34.0-rc.1","v2.33.0","v2.32.0","v2.31.0","v2.30.0","v2.29.0","v2.28.0","v2.27.0","v2.26.0","v2.25.0","v2.24.0","v2.23.0","v2.22.0","v2.21.0","v2.20.2","v2.20.1","v2.20.0","v2.19.0","v2.18.0","v2.17.0","v2.16.0","v2.15.0","v2.14.0","v2.13.0","v2.12.0","v2.11.0","v2.10.0","v2.9.0","v2.8.0","v2.7.1","v2.7.0","v2.6.0","v2.4.1","v2.5.0","v2.4.0","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.5","v2.2.4","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.4","v2.1.3","v2.1.2","v1.14.6","v2.1.1","v2.1.0","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.14.5","v1.14.4","v1.14.3","v1.14.2","v1.14.1","v1.13.3","v1.13.2","v1.13.1","v1.13.0","v1.12.6","v1.12.5","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.1","v1.11.0","v1.10.5","v1.10.0","v1.9.6","v1.9.3","v1.9.2","v1.9.1","v1.9.0","v1.8.43","v1.8.42","v1.8.41","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54801.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54801.json"},{"type":"ADVISORY","url":"https://github.com/gofiber/fiber/security/advisories/GHSA-qx2q-88mx-vhg7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54801"},{"type":"FIX","url":"https://github.com/gofiber/fiber/commit/e115c08b8f059a4a031b492aa9eef0712411853d"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-789"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54801.json"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}