CVE-2023-41338

Go/github.com/gofiber/fiber CVE-2023-41338: medium 5.3, EPSS 0.66%

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-3q5p-3558-364f
• https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f
• https://nvd.nist.gov/vuln/detail/CVE-2023-41338
• https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
• https://docs.gofiber.io/api/ctx#isfromlocal
• https://github.com/gofiber/fiber

CVE-2023-41338 · published 2023-09-08T13:27:21Z · modified 2026-09-10T03:50:03.184878597Z · JSON

Go/github.com/gofiber/fiber/v2 CVE-2023-41338: medium 5.3, EPSS 0.66%

Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`

Action: Upgrade github.com/gofiber/fiber/v2 to 2.49.2 or later.

go get github.com/gofiber/fiber/v2@v2.49.2

Affected

Fixed versions

Sources

• osv: GHSA-3q5p-3558-364f#Go/github.com/gofiber/fiber/v2
• https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f
• https://nvd.nist.gov/vuln/detail/CVE-2023-41338
• https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
• https://docs.gofiber.io/api/ctx#isfromlocal
• https://github.com/gofiber/fiber

CVE-2023-41338 · published 2023-09-08T13:27:21Z · modified 2026-09-10T03:50:03.184878597Z · JSON

Go/github.com/gofiber/fiber/v2 CVE-2023-41338: unknown, EPSS 0.66%

IsFromLocal local address check can be circumvented in github.com/gofiber/fiber/v2

Action: Upgrade github.com/gofiber/fiber/v2 to 2.49.2-0.20230906112033-b8c9ede6efa2 or later.

go get github.com/gofiber/fiber/v2@v2.49.2-0.20230906112033-b8c9ede6efa2

Affected

Fixed versions

Sources

• osv: GO-2023-2052
• https://github.com/gofiber/fiber/security/advisories/GHSA-3q5p-3558-364f
• https://github.com/gofiber/fiber/commit/b8c9ede6efa231116c4bd8bb9d5e03eac1cb76dc

CVE-2023-41338 · published 2023-09-12T17:31:22Z · modified 2024-05-20T16:03:47Z · JSON