SecBoard
Zurück zur CVE-Übersicht

CVE-2026-45045

MEDIUM(5.3)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Risk Signal Score23/100 — NIEDRIG
  • CVSS 5.3 — Mittel
  • Weniger als 24 Stunden alt

Beschreibung

Fiber is an Express inspired web framework written in Go. Prior to 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting X-Real-IP, allowing an attacker-supplied first X-Real-IP value to be forwarded to upstream servers for logging, rate limiting, and access control. This issue is fixed in version 3.3.0 and 2.52.14.

GitHub Advisories

GHSA-gcfq-8gqf-4876MEDIUM

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

go/github.com/gofiber/fiber/v3→ 3.3.0
GitHub Advisory

Referenzen