CVE-2026-44332: falha de média gravidade em gofiber fiber
Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
gofiber · fiberCVEs relacionadas — gofiber fiber
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15111MEDIUMCRLF vulnerability in FiberEPSS 0.9%CVE-2026-25891HIGHFiber has an Arbitrary File Read in Static Middleware on WindowsEPSS 0.7%CVE-2024-38513CRITICALFiber Session Middleware Token Injection VulnerabilityEPSS 0.7%CVE-2026-25882MEDIUMFiber has a Denial of Service Vulnerability via Route Parameter OverflowEPSS 0.7%CVE-2024-25124CRITICALFiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsEPSS 0.7%CVE-2023-41338MEDIUMVulnerability in Ctx.IsFromLocal() in gofiberEPSS 0.7%