CVE-2026-53624

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

4.8 MediumFix available

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol() for https instead of c.Scheme(). This issue is fixed in version 3.4.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.21%Unchanged since Jul 9, 2026

What each source reports

CVE List Score used 4.8

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Record: CVE-2026-53624
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-319
Updated: 2026-11-02

EUVDEUVD-2026-42356 4.8

Record: EUVD-2026-42356
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gv83-gqw6-9j2c 4.8

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Summary

The helmet middleware in gofiber/fiber never sets the Strict-Transport-Security (HSTS) response header, even when HSTSMaxAge is explicitly configured, because the condition check at helmet.go:67 uses c.Protocol() — which returns the HTTP protocol version string (e.g., "HTTP/1.1", "HTTP/2.0") — instead of c.Scheme() — which returns the URL scheme ("http" or "https"). Since c.Protocol() never equals "https" in any real deployment, the HSTS header is permanently disabled, defeating the security protection.

Details

Root cause: middleware/helmet/helmet.go, line 67:

if c.Protocol() == "https" && cfg.HSTSMaxAge != 0 {

c.Protocol() (defined at req.go:865-867) delegates to fasthttp.Request.Header.Protocol(), which returns the HTTP protocol version:

"HTTP/1.1" for HTTP/1.1 connections
"HTTP/2.0" for HTTP/2 connections

The correct method is c.Scheme() (defined at req.go:844-862), which returns:

"http" for plain HTTP connections
"https" for TLS connections

Since "HTTP/1.1" != "https" always evaluates to true, the entire HSTS block (lines 67-76) is dead code.

Note on test coverage: The existing helmet test (helmet_test.go) passes because it uses ctx.Request.Header.SetProtocol("https") to artificially force Protocol() to return "https". However, fasthttp.Request.Header.SetProtocol() sets the HTTP version field, and real HTTP requests never have protocol "https" — they have "HTTP/1.1" or "HTTP/2.0". The test is validating the wrong thing.

PoC

Clean-checkout maintainer-runnable recipe:

Save the following as middleware/helmet/poc_hsts_test.go:

package helmet

import (
    "crypto/tls"
    "net/http/httptest"
    "testing"

    "github.com/gofiber/fiber/v3"
)

func Test_PoC_HSTS_NeverSet(t *testing.T) {
    app := fiber.New()
    app.Use(New(Config{
        HSTSMaxAge: 31536000,
    }))
    app.Get("/", func(c fiber.Ctx) error {
        return c.SendString("ok")
    })

    // Simulate HTTPS connection
    req := httptest.NewRequest(fiber.MethodGet, "/", nil)
    req.TLS = &tls.ConnectionState{}

    resp, _ := app.Test(req)
    hsts := resp.Header.Get("Strict-Transport-Security")

    if hsts == "" {
        t.Log("BUG CONFIRMED: HSTS header not set. c.Protocol() returns 'HTTP/1.1', not 'https'")
        t.Log("Fix: change c.Protocol() == 'https' to c.Scheme() == 'https' on line 67")
    }
}

Run: go test -run Test_PoC_HSTS_NeverSet -v ./middleware/helmet/

Expected vulnerable output:

=== RUN   Test_PoC_HSTS_NeverSet
    BUG CONFIRMED: HSTS header not set. c.Protocol() returns 'HTTP/1.1', not 'https'
    Fix: change c.Protocol() == 'https' to c.Scheme() == 'https' on line 67
--- PASS: Test_PoC_HSTS_NeverSet

Expected output after fix:

=== RUN   Test_PoC_HSTS_NeverSet
--- PASS: Test_PoC_HSTS_NeverSet
    (HSTS header is set: "max-age=31536000; includeSubDomains")

Observed output from this environment (commit ee98695f):

=== RUN   Test_PoC_HSTS_NeverSet
    poc_hsts_test.go:39: HSTS header value: ""
    poc_hsts_test.go:42: BUG CONFIRMED: HSTS header is NOT set even over TLS
    poc_hsts_test.go:43: Root cause: helmet.go:67 uses c.Protocol() which returns HTTP version
    poc_hsts_test.go:44: c.Protocol() returns 'HTTP/1.1' not 'https'
    poc_hsts_test.go:45: Fix: use c.Scheme() == 'https' instead of c.Protocol() == 'https'
--- PASS: Test_PoC_HSTS_NeverSet

Negative/control case: With HSTSMaxAge: 0 (default), HSTS is correctly not set (this is expected behavior, not a bug).

Cleanup: Remove poc_hsts_test.go after verification.

Impact

The HSTS header is never applied in production, leaving all users vulnerable to:

SSL stripping attacks: An active network attacker can downgrade HTTPS connections to HTTP, intercepting traffic between the client and server.
Protocol downgrade: Without HSTS, browsers will silently accept HTTP…

Record: GHSA-gv83-gqw6-9j2c
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-319
Updated: 2026-11-02

NVD 4.8

Record: CVE-2026-53624
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSV 4.8

Fiber: HSTS header never set in helmet middleware due to incorrect protocol check

Record: CVE-2026-53624
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-319
Updated: 2026-11-02

OSVGHSA-gv83-gqw6-9j2c 4.8

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Summary

Details

Root cause: middleware/helmet/helmet.go, line 67:

if c.Protocol() == "https" && cfg.HSTSMaxAge != 0 {

c.Protocol() (defined at req.go:865-867) delegates to fasthttp.Request.Header.Protocol(), which returns the HTTP protocol version:

"HTTP/1.1" for HTTP/1.1 connections
"HTTP/2.0" for HTTP/2 connections

The correct method is c.Scheme() (defined at req.go:844-862), which returns:

"http" for plain HTTP connections
"https" for TLS connections

Since "HTTP/1.1" != "https" always evaluates to true, the entire HSTS block (lines 67-76) is dead code.

PoC

Clean-checkout maintainer-runnable recipe:

Save the following as middleware/helmet/poc_hsts_test.go:

package helmet

import (
    "crypto/tls"
    "net/http/httptest"
    "testing"

    "github.com/gofiber/fiber/v3"
)

func Test_PoC_HSTS_NeverSet(t *testing.T) {
    app := fiber.New()
    app.Use(New(Config{
        HSTSMaxAge: 31536000,
    }))
    app.Get("/", func(c fiber.Ctx) error {
        return c.SendString("ok")
    })

    // Simulate HTTPS connection
    req := httptest.NewRequest(fiber.MethodGet, "/", nil)
    req.TLS = &tls.ConnectionState{}

    resp, _ := app.Test(req)
    hsts := resp.Header.Get("Strict-Transport-Security")

    if hsts == "" {
        t.Log("BUG CONFIRMED: HSTS header not set. c.Protocol() returns 'HTTP/1.1', not 'https'")
        t.Log("Fix: change c.Protocol() == 'https' to c.Scheme() == 'https' on line 67")
    }
}

Run: go test -run Test_PoC_HSTS_NeverSet -v ./middleware/helmet/

Expected vulnerable output:

=== RUN   Test_PoC_HSTS_NeverSet
    BUG CONFIRMED: HSTS header not set. c.Protocol() returns 'HTTP/1.1', not 'https'
    Fix: change c.Protocol() == 'https' to c.Scheme() == 'https' on line 67
--- PASS: Test_PoC_HSTS_NeverSet

Expected output after fix:

=== RUN   Test_PoC_HSTS_NeverSet
--- PASS: Test_PoC_HSTS_NeverSet
    (HSTS header is set: "max-age=31536000; includeSubDomains")

Observed output from this environment (commit ee98695f):

=== RUN   Test_PoC_HSTS_NeverSet
    poc_hsts_test.go:39: HSTS header value: ""
    poc_hsts_test.go:42: BUG CONFIRMED: HSTS header is NOT set even over TLS
    poc_hsts_test.go:43: Root cause: helmet.go:67 uses c.Protocol() which returns HTTP version
    poc_hsts_test.go:44: c.Protocol() returns 'HTTP/1.1' not 'https'
    poc_hsts_test.go:45: Fix: use c.Scheme() == 'https' instead of c.Protocol() == 'https'
--- PASS: Test_PoC_HSTS_NeverSet

Negative/control case: With HSTSMaxAge: 0 (default), HSTS is correctly not set (this is expected behavior, not a bug).

Cleanup: Remove poc_hsts_test.go after verification.

Impact

The HSTS header is never applied in production, leaving all users vulnerable to:

SSL stripping attacks: An active network attacker can downgrade HTTPS connections to HTTP, intercepting traffic between the client and server.
Protocol downgrade: Without HSTS, browsers will silently accept HTTP…

Record: GHSA-gv83-gqw6-9j2c
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-319
Updated: 2026-11-02

Show 5 moreShow less

OSVUBUNTU-CVE-2026-53624 4.8

Record: UBUNTU-CVE-2026-53624
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVGO-2026-5912 No score

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber

Record: GO-2026-5912
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: openSUSE-SU-2026:21551-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23227-1
Updated: 2026-11-02

Affected products

gofiber fiber

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/gofiber/fiber` Go	through 3.3.0	3.4.0
`github.com/gofiber/fiber` Go	before 3.4.0	3.4.0
`github.com/gofiber/fiber/v3` Go	before 3.4.0	3.4.0
`govulncheck-vulndb` SUSE:Linux Enterprise Server 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`golang-github-gofiber-fiber` Ubuntu:26.10	All versions, plus listed versions 3.3.0-13.4.0-13.5.0-13.5.0-4	None known
`golang-github-gofiber-fiber-v2` Ubuntu:26.10	All versions, plus listed versions 2.52.13-22.52.13-3	None known
`govulncheck-vulndb` openSUSE:Leap 16.0 From an advisory covering 77 CVEs	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-53624 is a medium vulnerability (CVSS 4.8) in Gofiber Fiber, published July 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in github.com/gofiber/fiber 3.4.0.

References

Show 83 moreShow less

This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.