Vulnerability Details CVE-2025-66565
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.8%
CVSS Severity
CVSS v3 Score 9.8
References
Products affected by CVE-2025-66565
-
cpe:2.3:a:gofiber:utils:0.0.1
-
cpe:2.3:a:gofiber:utils:0.0.10
-
cpe:2.3:a:gofiber:utils:0.0.2
-
cpe:2.3:a:gofiber:utils:0.0.3
-
cpe:2.3:a:gofiber:utils:0.0.4
-
cpe:2.3:a:gofiber:utils:0.0.5
-
cpe:2.3:a:gofiber:utils:0.0.6
-
cpe:2.3:a:gofiber:utils:0.0.7
-
cpe:2.3:a:gofiber:utils:0.0.8
-
cpe:2.3:a:gofiber:utils:0.0.9
-
cpe:2.3:a:gofiber:utils:0.1.0
-
cpe:2.3:a:gofiber:utils:0.1.1
-
cpe:2.3:a:gofiber:utils:0.1.2
-
cpe:2.3:a:gofiber:utils:1.0.0
-
cpe:2.3:a:gofiber:utils:1.0.1
-
cpe:2.3:a:gofiber:utils:1.1.0
-
cpe:2.3:a:gofiber:utils:1.2.0
-
cpe:2.3:a:gofiber:utils:2.0.0