CVE-2026-44332

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gofiber/fiber/commit/c7ac00edd19f9669b1aebbec6e229658baaa059e	Patch
https://github.com/gofiber/fiber/pull/4245	Issue Tracking Patch
https://github.com/gofiber/fiber/releases/tag/v3.3.0	Release Notes
https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Fiber es un framework web inspirado en Express escrito en Go. Antes de la versión 3.3.0, la función Authorizer predeterminada en el middleware BasicAuth en middleware/basicauth/config.go utiliza evaluación de cortocircuito que omite la comparación del hash de la contraseña para nombres de usuario inexistentes, lo que permite una enumeración remota fiable de nombres de usuario a través de diferencias en el tiempo de respuesta. Este problema está solucionado en la versión 3.3.0.

Information

Published : 2026-07-08 20:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-44332

Mitre link : CVE-2026-44332

CVE.ORG link : CVE-2026-44332

JSON object : View

Products Affected

gofiber

fiber

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2026-44332", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44332", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:33:24.172923Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gofiber", "product": "fiber", "versions": [{"status": "affected", "version": "< 3.3.0"}]}]}], "published": "2026-07-08T20:16:49.773", "references": [{"url": "https://github.com/gofiber/fiber/commit/c7ac00edd19f9669b1aebbec6e229658baaa059e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gofiber/fiber/pull/4245", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gofiber/fiber/releases/tag/v3.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gofiber/fiber/security/advisories/GHSA-g5vh-55hw-rxm8", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "Fiber is an Express inspired web framework written in Go. Prior to 3.3.0, the default Authorizer function in the BasicAuth middleware in middleware/basicauth/config.go uses short-circuit evaluation that skips password hash comparison for non-existent usernames, enabling reliable remote username enumeration through response timing differences. This issue is fixed in version 3.3.0."}, {"lang": "es", "value": "Fiber es un framework web inspirado en Express escrito en Go. Antes de la versi\u00f3n 3.3.0, la funci\u00f3n Authorizer predeterminada en el middleware BasicAuth en middleware/basicauth/config.go utiliza evaluaci\u00f3n de cortocircuito que omite la comparaci\u00f3n del hash de la contrase\u00f1a para nombres de usuario inexistentes, lo que permite una enumeraci\u00f3n remota fiable de nombres de usuario a trav\u00e9s de diferencias en el tiempo de respuesta. Este problema est\u00e1 solucionado en la versi\u00f3n 3.3.0."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gofiber:fiber:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "91FCF443-EDF5-49A3-B84E-764942F2AF27", "versionEndExcluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}