https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:50:53.150707+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-262941 EUVD-2026-262941 2026-10-05T15:50:53.196894+00:00 EUVD-2026-262941 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66565 fkie_cve-2025-66565 2026-10-05T15:50:53.196931+00:00

Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.

 https://cve.radiocsirt.org/vuln/ghsa-m98w-cqp3-qcqr GHSA-m98w-cqp3-qcqr — Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values 2026-10-05T15:50:53.196967+00:00

Affected: Go: github.com/gofiber/utils/v2, Go: github.com/gofiber/utils

## Summary

Critical security vulnerabilities exist in both the `UUIDv4()` and `UUID()` functions of the `github.com/gofiber/utils` package. When the system's cryptographic random number generator (`crypto/rand`) fails, both functions silently fall back to returning predictable UUID values, the zero UUID `"00000000-0000-0000-0000-000000000000"`. This compromises the security of all Fiber applications using these functions for security-critical operations on **Go versions prior to 1.24**.

**Both functions are vulnerable to the same root cause (`crypto/rand` failure):**

* `UUIDv4()`: Indirect vulnerability through `uuid.NewRandom()` → `crypto/rand.Read()` → fallback to `UUID()` * `UUID()`: Direct vulnerability through `crypto/rand.Read(uuidSeed[:])` → silent zero UUID return

> **Note:** Go 1.24 and later panics on `crypto/rand` `Read()` failures, mitigating this vulnerability. Applications running on Go 1.24+ are not affected by the silent fallback behavior.

---

## Vulnerability Details

### Affected Functions

* **Package**: `github.com/gofiber/utils` * **Functions**: `UUIDv4()` and `UUID()` * **Return Type**: `string` (both functions) * **Locations**: `common.go:93-99` (UUIDv4), `common.go:60-89` (UUID)

### Technical Description

The vulnerability occurs through two related but distinct failure paths, both ultimately caused by `crypto/rand.Read()` failures on Go < 1.24:

#### Primary Path: UUIDv4() Vulnerability

1. `UUIDv4()` calls `google/uuid.NewRandom()` which inte…