CVE-2025-66565
CriticalSummary
Fiber Utils up to version 2.0.0-rc.3 contains a vulnerability where, if the crypto/rand random number generator fails, UUID functions silently return predictable values, including the zero UUID. The issue stems from crypto/rand.Read() failures and compromises the security of applications using these functions for security-critical operations. Fixed in version 2.0.0-rc.4.
Risk Assessment
If the random number generator fails, generated UUIDs can be predictable, potentially allowing an attacker to guess identifiers and compromise security operations.
Recommendation
Upgrade Fiber Utils to version 2.0.0-rc.4 or later to ensure secure UUID generation.
Original NVD description (English source)
Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000000-0000-0000-0000-000000000000". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.