Bug 2438199 (CVE-2025-66630)

Summary: CVE-2025-66630 github.com/gofiber/fiber/v2: Fiber: Predictable UUIDs from randomness source errors can lead to security bypasses
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Fiber web framework (github.com/gofiber/fiber/v2). On Go versions prior to 1.24, the framework's Universally Unique Identifier (UUID) generation functions do not return an error when the underlying cryptographic randomness source fails. This can cause applications to use predictable or low-entropy UUIDs in security-sensitive areas, such as session management or Cross-Site Request Forgery (CSRF) protection. An attacker could potentially exploit this by leveraging environmental conditions or application-specific weaknesses, which may significantly affect confidentiality and integrity.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2438803, 2438804, 2438805, 2438806    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-09 20:01:34 UTC 
Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.