https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 22:31:56 +0000 https://db.gcve.eu/vuln/cve-2026-119285 <p><strong>Affected:</strong> gofiber fiber</p> <p>Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware&#39;s validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker&#39;s page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.</p> <p><strong>Affected:</strong> gofiber fiber</p> <p>Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware&#39;s validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdomain AllowOrigins value and AllowCredentials enabled can reflect an unrelated attacker-controlled origin whose host merely ends with the configured base domain. A user who visits that origin can expose authenticated cross-origin responses to the attacker&#39;s page; empty-label origins and later comma-space parsing hardening are outside this advisory. This issue is fixed in version 2.52.3.</p> https://db.gcve.eu/vuln/cve-2026-119285