Bug 2386669 (CVE-2025-54801)

Summary: CVE-2025-54801 github.com/gofiber/fiber/v2: Fiber: Out-of-Bounds Slice Allocation Crash
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in github.com/gofiber/fiber/v2. The `Ctx.BodyParser` function fails to properly validate numeric form keys, allowing a large integer value to be interpreted as a slice index. This flaw allows a remote attacker to trigger this condition by submitting a crafted form with a sufficiently large numeric key. This issue leads to panic within the application, potentially resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2386781, 2386782, 2386783, 2386784    
Bug Blocks:    

Description OSIDB Bzimport 2025-08-06 00:02:05 UTC 
Fiber is an Express inspired web framework written in Go. In versions 2.52.8 and below, when using Fiber's Ctx.BodyParser to parse form data containing a large numeric key that represents a slice index (e.g., test.18446744073704), the application crashes due to an out-of-bounds slice allocation in the underlying schema decoder. The root cause is that the decoder attempts to allocate a slice of length idx + 1 without validating whether the index is within a safe or reasonable range. If the idx is excessively large, this leads to an integer overflow or memory exhaustion, causing a panic or crash. This is fixed in version 2.52.9.