Go Fiber v3.3.0 Security Advisory: DNS Rebinding, Memory Growth, Panic, Cookie Issues

Vulnerability Overview In version v3.3.0, the Fiber framework has multiple security-related issues, including: 1. DNS Rebinding Attack: The middleware does not properly validate the header, potentially leading to DNS rebinding attacks. 2. Memory Growth Issue: The method in the middleware may cause memory growth. 3. Non-Structured Listener Panic in TLS Configuration Discovery: Handling TLS configuration in a non-structured listener may trigger a panic. 4. Clearing Plaintext Cookies on Encryption Failure: Plaintext cookies are not correctly cleared when encryption fails. 5. Regular Expression Route Constraint Parsing Error: There is an error in the parsing of regular expression route constraints. 6. Rejection of Empty Normalized Host Before Dynamic Match: Empty normalized hosts are rejected before dynamic matching. 7. Insufficient Protection for Expired Responses: Protection against expired responses is inadequate. 8. Issues with Cookie Domain Acceptance and Host-Only Cookie Matching: There are problems with cookie domain acceptance and host-only cookie matching. 9. Panic When Releasing Fiber Context Values: Reading released Fiber context values may trigger a panic. 10. Static Root Issues in Reverse Proxy Directory Service: There are issues with the static root in the reverse proxy directory service. 11. Pagination Start Overflow: The pagination start value may overflow. 12. SharedState Namespace Key Conflicts: SharedState namespace keys may conflict. 13. FullURL String Copying Before Returning to Pooled Buffer: The FullURL string is not correctly copied before being returned to the pooled buffer. 14. Pagination Sorting When AllowedSorts is Not Set: There are issues with pagination sorting when AllowedSorts is not set. 15. Workflow Version Update Verification and Secure Application: Issues exist with workflow version update verification and secure application implementation. 16. BodyStream Closure in FiberHandler Stream Path: BodyStream in the FiberHandler stream path is not properly closed. 17. Panic When MsgPack is Not Configured: A panic may occur when MsgPack is not configured. 18. Issues with Retaining Only Loopback Addresses and Adding Unix Socket Support: There are issues with retaining only loopback addresses and adding Unix socket support. 19. Panic When CBOR is Not Explicitly Configured: A panic may occur when CBOR is not explicitly configured. 20. Insufficient Protection for Session Logger Tags: Protection for session logger tags is inadequate. 21. Issues with X-Real-IP Protection and Forward and DomainForward Variants: There are issues with X-Real-IP protection and the Forward and DomainForward variants. 22. BalancerForward Overwriting X-Real-IP Header: BalancerForward overwrites the X-Real-IP header. 23. Insufficient Test Coverage for multipart BodyLimit Error Handling: Test coverage for multipart BodyLimit error handling is insufficient. 24. Improvements in Express-Style Error Propagation: Improvements in Express-style error propagation. 25. SSE Next and Clarification of SSE Handler Documentation: SSE Next and clarification of SSE handler documentation. 26. BasicAuth Validator for Unknown Users: Issues exist with the BasicAuth validator for unknown users. Impact Scope DNS Rebinding Attack: All applications using the middleware. Memory Growth Issue: All applications using the middleware. Non-Structured Listener Panic in TLS Configuration Discovery: All applications using TLS configuration. Clearing Plaintext Cookies on Encryption Failure: All applications using encrypted cookies. Regular Expression Route Constraint Parsing Error: All applications using regular expression route constraints. Rejection of Empty Normalized Host Before Dynamic Match: All applications using dynamic matching. Insufficient Protection for Expired Responses: All applications handling expired responses. Issues with Cookie Domain Acceptance and Host-Only Cookie Matching: All applications using cookies. Panic When Releasing Fiber Context Values: All applications using Fiber contexts. Static Root Issues in Reverse Proxy Directory Service: All applications using reverse proxy directory services. Pagination Start Overflow: All applications using pagination. SharedState Namespace Key Conflicts: All applications using SharedState. FullURL String Copying Before Returning to Pooled Buffer: All applications using pooled buffers. Pagination Sorting When AllowedSorts is Not Set: All applications using pagination sorting. Workflow Version Update Verification and Secure Application: All applications using workflow version updates. BodyStream Closure in FiberHandler Stream Path: All applications using FiberHandler streams. Panic When MsgPack is Not Configured: All applications using MsgPack. Issues with Retaining Only Loopback Addresses and Adding Unix Socket Support: All applications using loopback addresses and Unix sockets. Panic When CBOR is Not Explicitly Configured: All applications using CBOR. Insufficient Protection for Session Lo

Goal Reached Thanks to every supporter — we hit 100%!

Go Fiber v3.3.0 Security Advisory: DNS Rebinding, Memory Growth, Panic, Cookie Issues

More from this source