PT-2026-21803 · Fiber · Fiber
Tuliperis
·
Published
2026-02-24
·
Updated
2026-03-03
·
CVE-2026-25899
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Fiber versions prior to 3.1.0
Description
The use of the
fiber flash cookie can lead to an unbounded allocation on any server. A specially crafted 10-character cookie value triggers an attempt to allocate up to 85GB of memory through unvalidated msgpack deserialization. No authentication is required, and every GoFiber v3 endpoint is affected, regardless of whether the application uses flash messages. The issue stems from the parseAndClearFlashMessages() function, which hex-decodes the cookie value and passes it directly to msgpack deserialization without size or content validation. The auto-generated tinylib/msgp deserialization reads a uint32 array header from the attacker-controlled byte stream and uses it directly in a make() call, resulting in the unbounded allocation. The vulnerable function is UnmarshalMsg(). The cookie value is a hex-encoded msgpack array32 header.Recommendations
Update to Fiber version 3.1.0 or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Fiber